.env to Kubernetes ConfigMap/Secret

How it works

The .env text is parsed line by line the same way as this site's .env File Validator: blank lines and lines starting with # are skipped, a leading "export " is stripped, the first "=" splits key from value, and values wrapped in matching single or double quotes are unquoted (double-quoted values also unescape \n, \t, \" and \\, matching common dotenv behavior). In ConfigMap mode each key's value is written as-is under data:. In Secret mode each value's UTF-8 bytes are base64-encoded with TextEncoder + btoa() before being written under data: — the identical encode step used by this site's Kubernetes Secret Decoder, so round-tripping a Secret between the two tools gives back the original value. It is important to understand what that base64 step does and does not do: base64 is a reversible text encoding, not encryption. A Kubernetes Secret's data: values can be decoded by anyone with read access to that Secret object (or to the cluster's etcd store) in a single command — they are not scrambled or protected by a key. Actual confidentiality for Secrets comes from cluster-level controls this tool has no involvement in: RBAC rules restricting who can read Secret objects, and encryption-at-rest configured for etcd, which is not enabled by default on every cluster.

FAQ

Does putting a value in a Kubernetes Secret actually encrypt it?

No. A Secret's data: values are base64-encoded, not encrypted — base64 is a reversible text encoding, not a cipher, and anyone with kubectl access to the Secret (or etcd access on the cluster) can decode it in one command. Real protection comes from RBAC rules limiting who can read Secret objects and from enabling encryption-at-rest for etcd, both of which are cluster configuration this tool has no part in.

What happens to duplicate keys in the .env file?

Only the last occurrence of a duplicate key is included in the generated manifest — this matches how most .env loaders behave, silently keeping whichever value was parsed last. Each duplicate is still counted and flagged above the output so you can catch it before it surprises you in production.