bash-herestring-newline-secrets

Bash Here-String Newline in Secrets

Problem

When creating secrets using bash here-strings (<<<), a trailing newline is silently appended to the value. This causes authentication failures with misleading error messages that suggest the password/token is wrong when it's actually correct—just with an extra newline character.

Context / Trigger Conditions

• Secret created with: gcloud secrets create NAME --data-file=- <<< "value"
• Or similar: echo "value" | gcloud secrets create... (echo adds newline by default)
• Error messages like:
  • "password authentication failed for user X"
  • "invalid token"
  • "authentication failed"
• The secret value appears correct when viewed
• Works locally but fails when secret is used

Solution

Wrong (adds newline):

gcloud secrets create my-secret --data-file=- <<< "mypassword"
echo "mypassword" | gcloud secrets create my-secret --data-file=-

Correct (no newline):

echo -n "mypassword" | gcloud secrets create my-secret --data-file=-
printf '%s' "mypassword" | gcloud secrets create my-secret --data-file=-

To fix an existing secret:

echo -n "correct-value" | gcloud secrets versions add my-secret --data-file=-

Verification

Check the secret length to detect trailing newline:

# Get secret and count bytes
gcloud secrets versions access latest --secret=my-secret | wc -c
# Compare to expected length (password length, not password length + 1)

Or use xxd to see the actual bytes:

gcloud secrets versions access latest --secret=my-secret | xxd | tail -1
# Look for '0a' (newline) at the end

Example

Symptom:

Database connection test failed: password authentication failed for user "crawler"

Investigation:

$ gcloud secrets versions access latest --secret=my-db-password
mypassword
$ gcloud secrets versions access latest --secret=my-db-password | wc -c
11  # But password is only 10 characters!

Fix:

$ echo -n "mypassword" | gcloud secrets versions add my-db-password --data-file=-
Created version [2] of the secret [my-db-password].