How do I load a plain text GCP secret into Kubernetes using external-secrets.io?

The error

unable to unmarshal secret: invalid character 'u' looking for beginning of value

usually happens because External Secrets is trying to parse a plain text secret as JSON. When you use the dataFrom extraction method, the operator assumes that the external secret value is a JSON object so it can extract multiple keys from it. Since your Google Cloud Secret Manager secret stores a plain string (like "userpassword"), the operator fails to parse it as JSON.

To fix this, you should switch from using dataFrom (which extracts all keys from a JSON object) to using data mapping. This way, you tell the operator to fetch the entire plain text content of your secret and assign it to a specific Kubernetes secret key.

Below is an example manifest that reads a plain text secret value from GCP Secrets Manager and loads it into a Kubernetes secret:

YAMLCopied
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: test-ext-secret-gcp
  namespace: myplatform
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: secret-store
  target:
    name: db-readonly-userpass
  data:
    - secretKey: password        # key in the created k8s secret
      remoteRef:
        key: gcp-db-readonly-userpass  # GCP secret name

Explanation

• data vs dataFrom

  • The dataFrom field is best when the stored secret is a JSON object from which you want to extract multiple key/value pairs.
  • The data field is used for extracting either a property from a JSON value (with an additional property field) or the complete value when the secret is plain text. In our case, we want the entire plain text secret.

• Mapping the Secret

  • secretKey: Specifies the key name in the resulting Kubernetes secret.
  • remoteRef.key: Points to the external secret name in GCP.
  • For plain text secrets, you don’t specify a property, because you want the operator to use the entire value.

With this configuration, the External Secrets operator will retrieve the plain text "userpassword" stored in GCP Secrets Manager and will create a Kubernetes secret db-readonly-userpass with a key password that contains that value.