<p>We are trying to use <code>github actions</code>, and we want to keep sensitive data such as <code>kubeconfig</code> inside the github <code>secrets</code>
I've created a GitHub secret with name <code>KUBECONFIG1</code></p>
<p><strong>Steps to reproduce</strong></p>
<p>In the GitHub secret I should store the following file also tried to convert to JSON with this <a href="https://onlineyamltools.com/convert-yaml-to-json" rel="nofollow noreferrer">https://onlineyamltools.com/convert-yaml-to-json</a></p>
<pre><code>apiVersion: v1
kind: Config
clusters:
  - name: brf
    cluster:
      certificate-authority-data: &gt;-
        LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURTakNBd0t6RXBNQ2NHQTFVRUF4TWdkbWx5ZE2bUljTlRtakFWCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
      server: 'https://vfg.canary.k8s.ondemand.com'
users:
  - name: user1
    user:
      token: &gt;-
        eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuW1lc3BhY2UiOiJnYXJkZW4tZGV2e
contexts:
  - name: g-root
    context:
      cluster: garv
      user: robot
      namespace: gking
current-context: gaot

</code></pre>
<p>in the github actions workflow we keep the file content above with the name <code>KUBECONFIG1</code> and create from it k8s secret.</p>
<pre><code>name: Example action

on: [push]

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v2
      - name: install k8s
        run: |
          curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE=777 sh -
          cat /etc/rancher/k3s/k3s.yaml
          mkdir -p ~/.kube
          cp /etc/rancher/k3s/k3s.yaml ~/.kube/config


     - run: 'echo -e &quot;$KUBECONFIG1&quot; &gt; ~/.tmpfile.json'
        shell: bash
        env:
          KUBECONFIG1: ${{secrets.KUBECONFIG1}}
    
      - name: example 
        shell: bash
        run: |
          cd ~/
          kubectl create secret generic project-kubecfg --from-file=~/.tmpfile.json -n default
</code></pre>
<p>After running this workflow I got the following error:</p>
<pre><code>error: error loading config file &quot;/home/runner/work/_temp/kubeconfig_1617030542039&quot;: couldn't get version/kind; json parse error: json: cannot unmarshal string into Go value of type struct *** APIVersion string &quot;json:\&quot;apiVersion,omitempty\&quot;&quot;; Kind string &quot;json:\&quot;kind,omitempty\&quot;&quot; ***
Error: Process completed with exit code 1.
</code></pre>
<p>I try also to take the file content and use
<a href="https://onlinelinuxtools.com/escape-shell-characters" rel="nofollow noreferrer">https://onlinelinuxtools.com/escape-shell-characters</a></p>
<p>As we work with Golang maybe I should take the kubeconfig and use it as go template and save the <code>sensitive-data</code> like <code>token</code> <code>certificate-authority-data</code> etc as github secret and during the workflow update the secrets value to the template but not sure how...</p>
<p><strong>What I need at the end</strong> I need that the following command will work in the workflow</p>
<p><code>kubectl create secret generic project-kubecfg --from-file=~/.tmpfile.json -n default</code></p>

PJEM
<p>The issue is with the below command</p>
<pre class="lang-yaml prettyprint-override"><code>kubectl create secret generic project-kubecfg --from-file=~/.tmpfile.json -n default
</code></pre>
<p>The problem is that <code>~</code> goes to <code>kubectl</code> which doesn't expand it to the home directory. So if you change it like below it will work</p>
<pre class="lang-yaml prettyprint-override"><code>kubectl create secret generic project-kubecfg --from-file=/home/runner/.tmpfile.json -n default
</code></pre>
<p>Or rather use a fixed path instead of home directory with <code>~</code></p>
