使用JSON文件内容与stringData字段创建Kubernetes Secret报错排查

问题场景 #

尝试创建包含GCP服务账号JSON密钥的Kubernetes Secret，使用stringData字段存储_json_key:JSON内容格式的凭据，但遇到以下解析错误：

error: error parsing argocd-image-updater-secret.yaml: error converting YAML to JSON: yaml: line 7: mapping values are not allowed in this context

原YAML内容：

apiVersion: v1
kind: Secret
metadata:
  name: image-secret
  type: Opaque
stringData:
   creds: _json_key:{"type": "service_account","project_id": "xyz","private_key_id": "9b0eb25b41ae9161123dbfh56mgj","private_key": "-----BEGIN PRIVATE KEY-----
mch0iiFz1DAdM8vQTXiETI+3gvSnknXQ0M5WmkA1dkiJgyhe3r8tpeb42jo4FCd
bHLf9eeIql8TKEm9BAk+qnQZq8FykWEnQLuU7APrFNZ0qtYP8t1Y7HSGpdVmmCyK
ykJAGznKaiEf9SJiNy8HqJy1kOhajn1fL3CdcShWcY793qRLyeFyrIZ
6lfnjSE9IW5iEOBmxEpXf5Q=
-----END PRIVATE KEY-----
","client_email": "argocd-image-updater@xyz.iam.","client_id": "113522222222222222222222222","auth_uri": "https://accounts.google.com,","token_uri": "https://oauth.googleap,","auth_provider_x509_cert_url": "https://www.googleapis.com/oauth/v1/certs","client_x509_cert_url": "https://www.googleapis.com/v1"}

错误原因 #

1. YAML解析器会将以{开头的内容识别为映射结构，和前面的_json_key:冲突，触发"mapping values not allowed"错误。
2. 多行的私钥字符串没有正确处理换行，导致YAML格式混乱。
3. 原JSON内容存在语法错误（部分字段值末尾多余逗号，比如"https://accounts.google.com,"）。

解决方案 #

使用YAML的**块标量语法（|）**处理多行字符串，同时修正JSON语法错误：

apiVersion: v1
kind: Secret
metadata:
  name: image-secret
  type: Opaque
stringData:
  creds: |
    _json_key:{"type": "service_account","project_id": "xyz","private_key_id": "9b0eb25b41ae9161123dbfh56mgj","private_key": "-----BEGIN PRIVATE KEY-----
mch0iiFz1DAdM8vQTXiETI+3gvSnknXQ0M5WmkA1dkiJgyhe3r8tpeb42jo4FCd
bHLf9eeIql8TKEm9BAk+qnQZq8FykWEnQLuU7APrFNZ0qtYP8t1Y7HSGpdVmmCyK
ykJAGznKaiEf9SJiNy8HqJy1kOhajn1fL3CdcShWcY793qRLyeFyrIZ
6lfnjSE9IW5iEOBmxEpXf5Q=
-----END PRIVATE KEY-----
","client_email": "argocd-image-updater@xyz.iam","client_id": "113522222222222222222222222","auth_uri": "https://accounts.google.com","token_uri": "https://oauth.googleap","auth_provider_x509_cert_url": "https://www.googleapis.com/oauth/v1/certs","client_x509_cert_url": "https://www.googleapis.com/v1"}

修改说明 #

• 用|标记块标量，告诉YAML解析器保留后续内容的换行和格式，避免将{识别为映射结构。
• 移除了JSON中字段值末尾的多余逗号（比如"https://accounts.google.com,"改为"https://accounts.google.com"），确保JSON语法合法。
• 块标量下的内容需保持统一缩进，与creds:层级匹配。

另一种可选方案：将整个creds值用单引号包裹，同时修正JSON错误：

apiVersion: v1
kind: Secret
metadata:
  name: image-secret
  type: Opaque
stringData:
  creds: '_json_key:{"type": "service_account","project_id": "xyz","private_key_id": "9b0eb25b41ae9161123dbfh56mgj","private_key": "-----BEGIN PRIVATE KEY-----
mch0iiFz1DAdM8vQTXiETI+3gvSnknXQ0M5WmkA1dkiJgyhe3r8tpeb42jo4FCd
bHLf9eeIql8TKEm9BAk+qnQZq8FykWEnQLuU7APrFNZ0qtYP8t1Y7HSGpdVmmCyK
ykJAGznKaiEf9SJiNy8HqJy1kOhajn1fL3CdcShWcY793qRLyeFyrIZ
6lfnjSE9IW5iEOBmxEpXf5Q=
-----END PRIVATE KEY-----
","client_email": "argocd-image-updater@xyz.iam","client_id": "113522222222222222222222222","auth_uri": "https://accounts.google.com","token_uri": "https://oauth.googleap","auth_provider_x509_cert_url": "https://www.googleapis.com/oauth/v1/certs","client_x509_cert_url": "https://www.googleapis.com/v1"}'

这种方式通过单引号将整个值包裹，让YAML解析器将其视为纯字符串，避免解析内部的{和特殊字符。

内容的提问来源于stack exchange，提问作者gaurav agnihotri