<p>I am preparing a k8 manifest to deploy one custom application and that requires a &quot;git clone&quot; in some pods and I face an error with it.</p>
<p>So I thought of first isolating the git part and testing in a simple pod. But I get the same error there as well.</p>
<p>Error is:</p>
<pre><code>URL using bad/illegal format or missing URL
</code></pre>
<p>My test pod and secret YAML manifest as follows:</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: secret-manager
  namespace: sec-manager
type: Opaque
data:
  gitlab-access-token: SOMETOKEN

---

apiVersion: v1
kind: Pod
metadata:
  name: &quot;sec-manager&quot;
  namespace: sec-manager
  labels:
    app: sec-manager
    use: passwordmanager
spec:
  containers:
  - name: disk-checker
    image: &quot;alpine:latest&quot;
    command: [&quot;/bin/sh&quot;]
    args:
      - &quot;-c&quot;
      - |
        apk add --no-cache git;
        git --version;
        cd /root;
        git clone https://gitlab-ci-token:$GITLABTOKEN@gitlab.com/ORG/infra/deploy/apps/sec-manager.git;
        sleep 9999;
    env:
      - name:  GITLABTOKEN
        valueFrom:
          secretKeyRef:
            name:  secret-manager
            key:  gitlab-access-token
</code></pre>
<p>Pod log shows the git clone command fails:</p>
<pre><code>→ kubectl -n sec-manager logs sec-manager 
fetch https://dl-cdn.alpinelinux.org/alpine/v3.16/main/x86_64/APKINDEX.tar.gz
fetch https://dl-cdn.alpinelinux.org/alpine/v3.16/community/x86_64/APKINDEX.tar.gz
(1/7) Installing ca-certificates (20220614-r0)
(2/7) Installing brotli-libs (1.0.9-r6)
(3/7) Installing nghttp2-libs (1.47.0-r0)
(4/7) Installing libcurl (7.83.1-r4)
(5/7) Installing expat (2.5.0-r0)
(6/7) Installing pcre2 (10.40-r0)
(7/7) Installing git (2.36.3-r0)
Executing busybox-1.35.0-r17.trigger
Executing ca-certificates-20220614-r0.trigger
OK: 19 MiB in 21 packages
git version 2.36.3
Cloning into '@gitlab.com/ORG/infra/deploy/apps/sec-manager.git'...
fatal: unable to access 'https://gitlab-ci-token:glpat-252jb98b39/': URL using bad/illegal format or missing URL
</code></pre>
<p>But if I run the following command manually inside the same pod, it works fine.</p>
<pre><code>git clone https://gitlab-ci-token:$GITLABTOKEN@gitlab.com/ORG/infra/deploy/apps/sec-manager.git
</code></pre>
<p>so I believe some YAML parsing error of some characters in shell commands in Pod but unable to figure out which one and how exactly to correct the lines.</p>
<p>Any ideas?</p>

vjwilson
<p>Found where the problem exists.</p>
<p>The issue is a newline being automatically added to the base64 encoded string.</p>
<p>For example, if the original token is 12345 we can base64 encode as follows:</p>
<pre><code>▶ echo &quot;12345&quot; | base64
MTIzNDUK
</code></pre>
<p>But there is a high chance a trailing space or newline comes at the end of the string and the encoded string will likely be wrong and not the encoded one of our actual token.</p>
<p>To prevent any trailing newline or space, use the flag <code>-n</code> with <code>echo</code>:</p>
<pre><code>▶ echo -n &quot;12345&quot; | base64
MTIzNDU=
</code></pre>
<p>You can see the encoded token difference compared to the first result.</p>
<p>Basically, the same issue was happening with my <code>gitlab-access-token</code> value from the Kubernetes secret <code>secret-manager</code>. The newline was breaking the git repo URL after the env variable <code>$GITLABTOKEN</code></p>
<p><a href="https://kubernetes.io/docs/tasks/configmap-secret/_print/" rel="nofollow noreferrer">reference1</a></p>
<p><a href="https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-kubectl/" rel="nofollow noreferrer">reference2</a></p>
<p><a href="https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-config-file/" rel="nofollow noreferrer">reference3</a></p>
<p><a href="https://i.stack.imgur.com/N4qjW.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/N4qjW.png" alt="enter image description here" /></a></p>
