How can I load a plain text GCP secret into Kubernetes using the external-secrets.io operator?

The error you see is because the operator is trying to parse your plain text value as JSON. When you use the dataFrom block, it expects the secret in GCP to be a JSON object so it can extract individual keys. Since your secret is just a plain text string ("userpassword"), the operator fails to unmarshal it.

To fix this, you should use the data mapping approach instead of dataFrom. This tells the operator to map the entire plain text value into a key in your Kubernetes secret.

Here’s an updated manifest:

YAMLCopied
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: test-ext-secret-gcp
  namespace: myplatform
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: secret-store
  target:
    name: db-readonly-userpass
  data:
  - secretKey: userpassword   # Kubernetes secret key
    remoteRef:
      key: gcp-db-readonly-userpass   # GCP secret name

In this configuration:

• The field under data tells the operator which key in your final Kubernetes secret should receive the value.
• The remoteRef.key value points to the GCP secret that contains your plain text.

This way, the operator reads the plain text directly and assigns it to the Kubernetes secret without trying to decode it as JSON.