<p>I have yaml which I used to create a secret using below command.</p>
<pre><code>kubectl create secret generic -n &lt;NAMESPACE&gt; gitlab-openid-connect --from-file=provider=provider.yaml
</code></pre>
<p>below is <code>Provider.yaml</code>:</p>
<pre><code>name: 'openid_connect'
label: 'OpenID SSO Login'
args:
  name: 'openid_connect'
  scope: ['openid','profile','email']
  response_type: 'code'
  issuer: 'https://keycloak.example.com/auth/realms/myrealm'
  discovery: true
  client_auth_method: 'basic'
  client_options:
    identifier: 'gitlab.example.com-oidc'
    secret: '&lt;keycloak clientID secret&gt;'
    redirect_uri: 'https://gitlab.example.com/users/auth/openid_connect/callback'
</code></pre>
<p>I want to convert it into a Secret yaml file so that I can run <code>kubectl apply -f provider.yaml</code></p>
<p>I tried to create below file but it does not work, <code>provider-new.yaml</code></p>
<pre><code>apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: 'openid_connect'
  label: 'OpenID SSO Login'
data:
  scope: ['openid','profile','email']
  response_type: 'code'
  issuer: 'url'
  discovery: true
  client_auth_method: 'basic'
  client_options:
    identifier: 'identifier'
    secret: 'secret-key'
    redirect_uri: 'url'
</code></pre>

<p>To make this work you need to use <code>--from-env-file</code> instead <code>--from-file</code>. And the file containing the variables should be in the plain text.</p>
<blockquote>
<p>To create a Secret from one or more files, use --from-file or
--from-env-file. The file must be plaintext, but the extension of the file does not matter.</p>
</blockquote>
<blockquote>
<p>When you create the Secret using --from-file, the value of the Secret
is the entire contents of the file. If the value of your Secret
contains multiple key-value pairs, use --from-env-file instead.</p>
</blockquote>
<p>File <code>provider.yaml</code> with variables:</p>
<pre><code>scope= ['openid','profile','email']
response_type= 'code'
issuer= 'url'
discovery= true
client_auth_method= 'basic'
identifier= 'identifier'
secret= 'secret-key'
redirect_uri= 'url'
</code></pre>
<pre><code>kubectl create secret generic -n default gitlab-openid-connect --from-env-file=provider.yaml
</code></pre>
<p>Result:</p>
<pre><code>apiVersion: v1
data:
  client_auth_method: ICdiYXNpYyc=
  discovery: IHRydWU=
  identifier: ICdpZGVudGlmaWVyJw==
  issuer: ICd1cmwn
  redirect_uri: ICd1cmwn
  response_type: ICdjb2RlJw==
  scope: IFsnb3BlbmlkJywncHJvZmlsZScsJ2VtYWlsJ10=
  secret: ICdzZWNyZXQta2V5Jw==
kind: Secret
metadata:
  creationTimestamp: null
  name: gitlab-openid-connect
  namespace: default
</code></pre>
<p>Another thing is that isn't possible to establish a hierarchy in the secret data scope, so the following isn't gonna work:</p>
<pre><code>client_options
  identifier= 'identifier'
  secret= 'secret-key'
  redirect_uri= 'url'
</code></pre>
<p>source: <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/secret?hl=en-us#creating_a_secret" rel="noreferrer">google cloud</a></p>
