[Question] Why double base64 encode Kubernetes secret?

[3deep5me]

It seems like the 1password-credentials.json is double encoded. First here https://github.com/1Password/connect-helm-charts/blob/282df930c29e8d9262b9533c3805616143849a50/charts/connect/templates/connect-credentials.yaml#L18 and then within Kubernetes https://github.com/1Password/connect-helm-charts/blob/282df930c29e8d9262b9533c3805616143849a50/charts/connect/templates/connect-credentials.yaml#L15 May I ask you what the reasons for this are?

I would like to create secret with kubernetes native tools, because the helm install is done over argocd/gitops and i can not store the token in my git. So i want to add the secret manually afterwards with this command.

kubectl create secret generic op-credentials -n external-secrets --from-file 1password-credentials.json

But right now this is not easily possible because the service expect the value in base64 encoding.

Would love to hear if there are reasons why its mandatory to have the 1password-credentials.json base64 encoded.

[volodymyrZotov]

Hi @3deep5me . This was done to address this issue https://github.com/1Password/connect-helm-charts/issues/67

Indeed, it looks like it will encode it twice if you pass base64 string. It needs to use

data:
  my-key: <your-base64-encoded-data>

for the base64 values.