We are currently implementing the use of github actions, with a focus on securely storing sensitive information like kubeconfig within github's secrets.
A GitHub secret has been set up under the name KUBECONFIG1
Steps to Replicate
The GitHub secret should contain the file below, attempted to be converted to JSON using this tool:
apiVersion: v1
kind: Config
clusters:
- name: brf
cluster:
certificate-authority-data: >-
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURTakNBd0t6RXBNQ2NHQTFVRUF4TWdkbWx5ZE2bUljTlRtakFWCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
server: 'https://vfg.canary.k8s.ondemand.com'
users:
- name: user1
user:
token: >-
eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuW1lc3BhY2UiOiJnYXJkZW4tZGV2e
contexts:
- name: g-root
context:
cluster: garv
user: robot
namespace: gking
current-context: gaot
Within the github actions workflow, we store the contents above with the name KUBECONFIG1 and utilize it to create a k8s secret.
name: Example action
on: [push]
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- uses: actions/checkout@v2
- name: install k8s
run: |
curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE=777 sh -
cat /etc/rancher/k3s/k3s.yaml
mkdir -p ~/.kube
cp /etc/rancher/k3s/k3s.yaml ~/.kube/config
- run: 'echo -e "$KUBECONFIG1" > ~/.tmpfile.json'
shell: bash
env:
KUBECONFIG1: ${{secrets.KUBECONFIG1}}
- name: example
shell: bash
run: |
cd ~/
kubectl create secret generic project-kubecfg --from-file=~/.tmpfile.json -n default
Upon running this workflow, the following error was encountered:
error: error loading config file "/home/runner/work/_temp/kubeconfig_1617030542039": couldn't get version/kind; json parse error: json: cannot unmarshal string into Go value of type struct *** APIVersion string "json:\"apiVersion,omitempty\""; Kind string "json:\"kind,omitempty\"" ***
Error: Process completed with exit code 1.
An attempt was made to extract the file content and utilize
Considering our work with Golang, there is a possibility of taking the kubeconfig and utilizing it as a go template. It may also involve safeguarding the sensitive-data such as token and certificate-authority-data within github secrets, with an update of these values during the workflow execution. The exact process for achieving this remains unclear...
Final Objective The command below needs to function seamlessly in the workflow
kubectl create secret generic project-kubecfg --from-file=~/.tmpfile.json -n default