动态创建K8s Secrets与Jobs：敏感占位符替换问题求助

我在Github Actions工作流中，从Snowflake获取schema列表，为每个schema动态创建K8s Job和对应的ConfigMap用于数据导入任务。当前流程是先拉取schema列表，再遍历替换模板占位符部署资源，但替换ConfigMap模板里的${SNOWFLAKE_PRIVATE_KEY}和${SNOWFLAKE_PRIVATE_KEY_PASS}时，遇到sed错误：

sed: -e expression #4, char 64: unterminated `s' command

错误触发自这条命令：

sed "s#\${SNOWFLAKE_PRIVATE_KEY}#${{ env.SNOWFLAKE_PRIVATE_KEY }}#g" "$(pwd)/k8s/sf-to-console-configmap-template.yml" > "$(pwd)/k8s/sf-to-console-configmap-$SANITIZED_SCHEMA_NAME.yml"  

怀疑是Github Actions对Snowflake密码做掩码（显示为*****）导致，但不确定，同时希望找到更优的占位符替换方案。工作流相关代码片段如下：

- name: Get vault secrets  
  uses: "redacted"  
  with:  
    vault-url: "redacted"  
    role-id: ${{ secrets.VAULT_PROD_ROLE_ID }}  
    secret-id: ${{ secrets.VAULT_PROD_SECRET_ID }}  
    auth-namespace: "redacted"  
    secret-namespace: "redacted"  
    secret-list: |  
      "redacted" 'rsa_key.p8' | SNOWFLAKE_PRIVATE_KEY;  
      "redacted" private_key_pass | SNOWFLAKE_PRIVATE_KEY_PASS;  

- name: Authenticate K8s / Setup kubectl  
  uses: "redacted"  
  with:  
    environment: dev  
    vault-role-id: ${{ secrets.VAULT_PROD_ROLE_ID }}  
    vault-secret-id: ${{ secrets.VAULT_PROD_SECRET_ID }}  

- name: Fetch schema list  
  id: fetch-schemas  
  run: |  
    python3 k8s/fetch-schemas.py  
  env:  
    SNOWFLAKE_PRIVATE_KEY: ${{ env.SNOWFLAKE_PRIVATE_KEY }}  
    SNOWFLAKE_PRIVATE_KEY_PASS: ${{ env.SNOWFLAKE_PRIVATE_KEY_PASS }}  
    SNOWFLAKE_USER: "redacted"  
    SNOWFLAKE_ACCOUNT: "redacted"  
    SNOWFLAKE_ROLE: "redacted"  
    SNOWFLAKE_WAREHOUSE: "redacted"  

- name: Loop through schemas and deploy  
  shell: bash
  run: |  
    SCHEMA_LIST=$(echo '${{ steps.fetch-schemas.outputs.schema_list }}' | jq -r '.[]')  
    for SCHEMA in $SCHEMA_LIST; do  
      echo "Processing schema: $SCHEMA"  
      export SCHEMA_NAME=$SCHEMA  
      SANITIZED_SCHEMA_NAME=$(echo $SCHEMA | sed 's/[_.]/-/g' | tr '[:upper:]' '[:lower:]')  

      # Echo the sanitized schema name  
      echo "Sanitized schema name: $SANITIZED_SCHEMA_NAME"
 
      # Fetch secrets from the vault step  
      SNOWFLAKE_PRIVATE_KEY="${{ env.SNOWFLAKE_PRIVATE_KEY }}"
      SNOWFLAKE_PRIVATE_KEY_PASS="${{ env.SNOWFLAKE_PRIVATE_KEY_PASS }}"

      echo "Current directory:"
      echo $(pwd)
      echo "Contents of k8s/sf-to-console-configmap-template.yml:"
      echo $(cat k8s/sf-to-console-configmap-template.yml)
     
      sed -e 's#\${SANITIZED_SCHEMA_NAME}#'"$SANITIZED_SCHEMA_NAME"'#g' -e 's#\${SCHEMA_NAME}#'"$SCHEMA_NAME"'#g' -e 's#\${SNOWFLAKE_ENV}#'"$ENV_CODE"'#g' "$(pwd)/k8s/sf-to-console-configmap-template.yml" > "$(pwd)/k8s/sf-to-console-configmap-$SANITIZED_SCHEMA_NAME.yml"  

      # Debug: Check the contents of the generated configmap file  
      echo "Contents of $(pwd)/k8s/sf-to-console-configmap-$SANITIZED_SCHEMA_NAME.yml:"  
      cat $(pwd)/k8s/sf-to-console-configmap-$SANITIZED_SCHEMA_NAME.yml  

      # Delete existing Configmap if it exists  
      kubectl delete configmap sf-to-console-configmap-$SANITIZED_SCHEMA_NAME --ignore-not-found  

      # Create Configmap
      kubectl apply -f $(pwd)/k8s/sf-to-console-configmap-$SANITIZED_SCHEMA_NAME.yml

      # Replace placeholder in Job file and apply  
      sed "s#\${SCHEMA_NAME}#$SANITIZED_SCHEMA_NAME#g" "$(pwd)/k8s/sf-to-console-job-template.yml" > "$(pwd)/k8s/sf-to-console-job-$SANITIZED_SCHEMA_NAME.yml" 

      # Debug: Check the contents of the generated job file  
      echo "Contents of k8s/sf-to-console-job-$SANITIZED_SCHEMA_NAME.yml:"  
      cat k8s/sf-to-console-job-$SANITIZED_SCHEMA_NAME.yml  

      # Delete existing Job if it exists  
      kubectl delete job sf-to-console-job-$SANITIZED_SCHEMA_NAME --ignore-not-found  
      
      kubectl apply -f k8s/sf-to-console-job-$SANITIZED_SCHEMA_NAME.yml  
    done  

错误原因分析 #

1. 特殊字符冲突：Snowflake私钥是PEM格式，包含换行符、/、+、#等特殊字符，sed用#作为分隔符时，私钥里的#会截断替换表达式，直接导致unterminated错误。
2. 变量解析时机问题：循环内直接使用${{ env.SNOWFLAKE_PRIVATE_KEY }}，Github Actions会在工作流解析阶段就替换这个值，而非运行时，导致sed命令被提前注入特殊字符。
3. 掩码机制干扰调试：Github Actions会自动将匹配Secrets格式的内容掩码为*****，但这仅影响日志输出，不会修改实际变量值，不是错误的直接原因，但会干扰问题排查。

解决方案 #

1. 修复sed替换的特殊字符问题 #

对私钥做base64编码，避免特殊字符干扰：

• 在获取Vault secrets后添加编码步骤：

- name: Encode Snowflake private key
  run: |
    echo "${{ env.SNOWFLAKE_PRIVATE_KEY }}" | base64 -w0 > SNOWFLAKE_PRIVATE_KEY_BASE64
    echo "SNOWFLAKE_PRIVATE_KEY_BASE64=$(cat SNOWFLAKE_PRIVATE_KEY_BASE64)" >> $GITHUB_ENV

• 模板文件中占位符改为${SNOWFLAKE_PRIVATE_KEY_BASE64}，替换时用sed（编码后无特殊分隔符）：

sed -e 's#${SNOWFLAKE_PRIVATE_KEY_BASE64}#'"$SNOWFLAKE_PRIVATE_KEY_BASE64"'#g' template.yml > output.yml

• 在K8s Job中使用时解码：

containers:
- name: import-job
  command: ["sh", "-c"]
  args:
    - echo "$SNOWFLAKE_PRIVATE_KEY_BASE64" | base64 -d > /tmp/rsa_key.p8 && ./import-script.sh

2. 改用envsubst进行模板替换（更优方案） #

sed不适合处理含大量特殊字符的变量，envsubst可直接替换环境变量占位符，避免转义问题：

• 模板文件中直接用环境变量名作为占位符：

apiVersion: v1
kind: ConfigMap
metadata:
  name: sf-to-console-configmap-${SANITIZED_SCHEMA_NAME}
data:
  SCHEMA_NAME: ${SCHEMA_NAME}
  SNOWFLAKE_PRIVATE_KEY: ${SNOWFLAKE_PRIVATE_KEY}
  SNOWFLAKE_PRIVATE_KEY_PASS: ${SNOWFLAKE_PRIVATE_KEY_PASS}

• 循环内设置环境变量后用envsubst生成文件：

export SANITIZED_SCHEMA_NAME=$SANITIZED_SCHEMA_NAME
export SCHEMA_NAME=$SCHEMA
# 指定仅替换需要的变量，避免误替换K8s原生的$引用
envsubst '$SANITIZED_SCHEMA_NAME:$SCHEMA_NAME:$SNOWFLAKE_PRIVATE_KEY:$SNOWFLAKE_PRIVATE_KEY_PASS' < template.yml > output.yml

3. 优化变量传递逻辑 #

避免在循环内直接引用${{ env.* }}，改为循环前将变量导出到shell环境：

- name: Loop through schemas and deploy
  shell: bash
  run: |
    # 预先导出敏感变量到shell环境
    export SNOWFLAKE_PRIVATE_KEY="${{ env.SNOWFLAKE_PRIVATE_KEY }}"
    export SNOWFLAKE_PRIVATE_KEY_PASS="${{ env.SNOWFLAKE_PRIVATE_KEY_PASS }}"
    
    SCHEMA_LIST=$(echo '${{ steps.fetch-schemas.outputs.schema_list }}' | jq -r '.[]')  
    for SCHEMA in $SCHEMA_LIST; do  
      # 后续循环逻辑...
    done

内容的提问来源于stack exchange，提问作者Andrew Smith