<p>I am taking over a k3s cluster and am trying to solve a problem with this:</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: clouddesktop-prod-secrets
  namespace: clouddesktop-prod
data:
  tskey: dHNrZXkta0drTWVWNkNOVFJMLVNlRkZKVFFRalM3RDgzRllvVkxCTQ==
</code></pre>
<p>... is used along with with this snippet in my deployment.yaml</p>
<pre><code>    - name: AUTHKEY
      valueFrom:
        secretKeyRef:
          name: clouddesktop-prod-secrets
          key: tskey
</code></pre>
<p>If I am understanding it correctly, the value under tskey will be &quot;decrypted&quot; and then made available as an envirnment variable called ENV_AUTHKEY.</p>
<p>In other words the decryption process that k3s applies will convert the encrypted value &quot;dHNrZXkta0drTWVWNkNOVFJMLVNlRkZKVFFRalM3RDgzRllvVkxCTQ==&quot; into a plaintext value, e.g. &quot;tskey-abc145f&quot; and makes it available to the runnning container as environment variable &quot;ENV_AUTHKEY&quot;</p>
<p>I have verified that indeed an environment variable called &quot;ENV_AUTHKEY&quot; is created, in other words that k3s appends ENV_ to the name.</p>
<p>But as far as I can tell the plaintext is wrong. The environment variable &quot;ENV_AUTHKEY&quot; is indeed created, but, it seems to not have the expected value.</p>
<p>Now by the documentation left for me by my predecessor, I am to create the encrypted value with this simple step:</p>
<pre><code>echo -n &quot;tskey-abc145f&quot; | base64
</code></pre>
<p>So I am using base64 as the &quot;encryption&quot; expecting that this is what k3s expects. But the eventually decrypted value appears to me to be incorrect.</p>
<p>What I am trying to determine is what k3s will use to decrypt my encrypted value.</p>

pitosalas
<p>To view how kubernetes would <strong>encode</strong> the input string, you &quot;may&quot; run the following:</p>
<pre><code>echo -n &quot;tskey-abc145f&quot; | base64
dHNrZXktYWJjMTQ1Zg==
</code></pre>
<p>In the following example, I am creating a secret from the command line and providing the key and value in plain text format.</p>
<pre><code>kubectl create secret  generic  clouddesktop-prod-secrets -n clouddesktop-prod --from-literal=tskey=tskey-abc145f
</code></pre>
<p>Verify the secret and its encoded value; here, you can notice the value is encoded automatically. However, when you create a secret using a manifest file, you would have to provided base64 encoded string.</p>
<pre><code>kubectl get secret clouddesktop-prod-secrets -n clouddesktop-prod
apiVersion: v1
kind: Secret
metadata:
  name: clouddesktop-prod-secrets
  namespace: clouddesktop-prod
data:
  tskey: dHNrZXktYWJjMTQ1Zg==
</code></pre>
<p>Validate that the encoded value present in the secret is decoding back to the original string(<code>tskey-abc145f</code>):</p>
<pre><code>kubectl get secrets -n clouddesktop-prod  clouddesktop-prod-secrets -o go-template='{{.data.tskey|base64decode}}'
tskey-abc145f
</code></pre>
<p>Tested on k3s:</p>
<pre><code>k3s --version
k3s version v1.23.3+k3s1 (5fb370e5)
go version go1.17.5
</code></pre>
