Search code examples
google-cloud-platformgoogle-container-buildergoogle-cloud-build

cloudbuil.yaml does not unmarshall when using base64-encoded value on build trigger

On my cloudbuild.yaml definition, I used to have a secrets section to get environment values from Google KMS. The secretEnv fields had keys mapping to 'encrypted + base64-encoded' values:

...

secrets:
- kmsKeyName: <API_PATH>
  secretEnv:
    <KEY>: <ENCRYPTED+BASE64>

I've tried to put this value on a substitution instead, which is replaced when a build trigger is used:

...

secrets:
- kmsKeyName: <API_PATH>
  secretEnv:
    <KEY>: ${_VALUE}

With that I intend to keep the file generic.

However, the build process keeps failing with a message failed unmarshalling build config cloudbuild.yaml: illegal base64 data at input byte 0. I've checked several times and the base64 value was not copied wrong into the substitution on the trigger.

Thank you in advance.

Solution

  • https://cloud.google.com/cloud-build/docs/configuring-builds/substitute-variable-values

    After reading Using user-defined substitutions section carefully, I've seen that

    The length of a parameter key is limited to 100 bytes and the length of a parameter value is limited to 4000 bytes.

    Mine was a 253-character long string.