.env to Kubernetes Secret

What is .env to Kubernetes Secret?

This tool converts a .env file into a Kubernetes Secret manifest — a type: Opaque object with each variable under data:, ready to kubectl apply against a cluster.

How it works

Variables are parsed the same way across every env-to-secrets converter (parseEnv: strips export, unwraps quoted values, skips comments and blanks). Each value is then run through a UTF-8-safe base64 encoder — plain btoa() breaks on non-Latin1 characters, so the tool encodes to bytes via TextEncoder first — and written as KEY: <base64> under data:, which is the field Kubernetes requires to hold base64 already-encoded values (as opposed to stringData:, which takes plain text and lets the API server encode it).

Features

• Custom Secret name field (defaults to app-secrets)
• UTF-8-safe base64 encoding for every value, including non-ASCII characters
• Generates type: Opaque, the generic key-value Secret type
• Handles quoted values and inline comments identically to the other .env converters
• Copy, download as .yaml, or load sample data

Example

Input (secret name: app-secrets):

DATABASE_URL=postgres://user:pass@localhost:5432/mydb
API_KEY="sk_live_abc123"
DEBUG=false
PORT=3000

Output:

apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
type: Opaque
data:
  DATABASE_URL: cG9zdGdyZXM6Ly91c2VyOnBhc3NAbG9jYWxob3N0OjU0MzIvbXlkYg==
  API_KEY: c2tfbGl2ZV9hYmMxMjM=
  DEBUG: ZmFsc2U=
  PORT: MzAwMA==

Common errors / edge cases

A common misconception worth stating plainly: base64 in a Kubernetes Secret is an encoding, not encryption. DEBUG: ZmFsc2U= decodes back to false with a single base64 -d — anyone with read access to the Secret (or the manifest itself) has the plaintext instantly. Real protection comes from Kubernetes RBAC restricting who can get Secrets, and encryption-at-rest for etcd, not from the encoding step. "No KEY=value lines found" means the input had no parseable assignments — check for stray blank lines or keys that aren't valid identifiers.

Best practices

Never commit the generated manifest to version control — it's exactly as sensitive as the original .env file, just re-encoded. For anything that does need to live in git, use a tool built for that (Sealed Secrets, SOPS, or your cloud provider's external-secrets integration) instead of a raw Secret manifest. Apply the generated file directly with kubectl apply -f rather than pasting it into a CI variable or chat message.