Description:

I am trying to push a secret to AWS Parameter Store using external-secrets (PushSecret) and encountered an issue with the Base64 decoding of certain fields. Specifically, the dbname and username fields are not being decoded correctly, while the password field works as expected.

Input Secret:

Here is the Kubernetes Secret I am working with:

apiVersion: v1
data:
  dbname: YXBw
  password: bnh5MDhjZmExanhVWGtYMjRoeE14WWlBSmxlQWZMeFE=
  username: c3VwYWJhc2VfYWRtaW4=
kind: Secret
metadata:
  name: postgres-credentials
  namespace: database-dev-ca
type: Opaque

PushSecret:

Here is the PushSecret configuration:

apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: postgres-credentials
  namespace: database-dev-ca
spec:
  data:
  - conversionStrategy: None
    match:
      remoteRef:
        remoteKey: /xxxxxxx/dev/postgres-creds
    metadata:
      parameterStoreType: SecureString
  deletionPolicy: Delete
  refreshInterval: 1h
  secretStoreRefs:
  - kind: ClusterSecretStore
    name: aws-cluster-secret-store
  selector:
    secret:
      name: postgres-credentials
  template:
    data:
      dbname: '{{ .dbname | b64dec }}'
      password: '{{ .password | b64dec }}'
      username: '{{ .username | b64dec }}'
    engineVersion: v2
    mergePolicy: Replace
  updatePolicy: Replace

Expected Output:

In AWS Parameter Store, I expected the following decoded secret:

{"dbname":"app","password":"nxy08cfa1jxUXkX24hxMxYiAJleAfLxQ","username":"supabase_admin"}

Actual Output:

However, I got the following:

{"dbname":"aWxsZWdhbCBiYXNlNjQgZGF0YSBhdCBpbnB1dCBieXRlIDA=","password":"nxy08cfa1jxUXkX24hxMxYiAJleAfLxQ","username":"aWxsZWdhbCBiYXNlNjQgZGF0YSBhdCBpbnB1dCBieXRlIDg="}

Additional Debugging:

When manually decoding the dbname and username values, I encountered errors:

• Decoding aWxsZWdhbCBiYXNlNjQgZGF0YSBhdCBpbnB1dCBieXRlIDA= results in: illegal base64 data at input byte 0
• Decoding aWxsZWdhbCBiYXNlNjQgZGF0YSBhdCBpbnB1dCBieXRlIDg= results in: illegal base64 data at input byte 8
• The password field is decoded correctly and works as expected.

Question:
• Is there something wrong with how I am using the b64dec function in the PushSecret template?
• Could there be an issue with how the external-secrets operator handles Base64 decoding for these fields?

Any insights or suggestions on what I might be doing wrong would be greatly appreciated!

Let me know if you need further details or logs.

external-secrets: 0.12.1