GoogleContainerTools/skaffold · error

unable to expand pullSecretPath %s

Error message

unable to expand pullSecretPath %s

What it means

setDefaultClusterPullSecret expands the configured kaniko pullSecretPath to an absolute path using homedir.Expand. If expansion fails (malformed path, e.g. invalid '~' usage), the error names the offending path and aborts defaults processing — note it deliberately discards the underlying error.

Source

Thrown at pkg/skaffold/schema/defaults/defaults.go:339

		if err != nil {
			return fmt.Errorf("getting current namespace: %w", err)
		}
		cluster.Namespace = ns
	}
	return nil
}

func setDefaultClusterTimeout(cluster *latest.ClusterDetails) error {
	cluster.Timeout = valueOrDefault(cluster.Timeout, kaniko.DefaultTimeout)
	return nil
}

func setDefaultClusterPullSecret(cluster *latest.ClusterDetails) error {
	cluster.PullSecretMountPath = valueOrDefault(cluster.PullSecretMountPath, kaniko.DefaultSecretMountPath)
	if cluster.PullSecretPath != "" {
		absPath, err := homedir.Expand(cluster.PullSecretPath)
		if err != nil {
			return fmt.Errorf("unable to expand pullSecretPath %s", cluster.PullSecretPath)
		}
		cluster.PullSecretPath = absPath
		random := ""
		if cluster.RandomPullSecret {
			uid, _ := uuid.NewUUID()
			random = uid.String()
		}
		cluster.PullSecretName = valueOrDefault(cluster.PullSecretName, kaniko.DefaultSecretName+random)
		return nil
	}
	return nil
}

func setDefaultClusterDockerConfigSecret(cluster *latest.ClusterDetails) error {
	if cluster.DockerConfig == nil {
		return nil
	}

View on GitHub (pinned to a1189de023)

Solutions

1. Set cluster.PullSecretPath to an absolute path (e.g. /secrets/pull-secret.json)
2. Ensure $HOME is set in the environment if using '~'-prefixed paths
3. Remove the pullSecretPath entry if not needed
4. Check for typos in the tilde expansion (e.g. '~user' forms unsupported in the runtime env)

Example fix

# before
deploy:
  kubectl:
    clusters:
      - pullSecretPath: ~/kaniko-secret.json
# after (absolute path, no $HOME dependency)
deploy:
  kubectl:
    clusters:
      - pullSecretPath: /secrets/kaniko-secret.json

if strings.HasPrefix(cluster.PullSecretPath, "~") && os.Getenv("HOME") == "" {
    return errors.New("pullSecretPath uses '~' but HOME is unset; use an absolute path")
}

When it happens

Trigger: Calling setDefaultClusterPullSecret when cluster.PullSecretPath is non-empty and homedir.Expand(cluster.PullSecretPath) returns an error — typically a path starting with '~' that cannot be resolved to a home directory (no HOME set) or an invalid path expression.

Common situations: pullSecretPath like "~/secret.json" in a container/CI where $HOME is unset, a malformed tilde path, or pull-secret config copied from another environment with a nonexistent home layout.

Related errors

• found a '%s' artifact, which is incompatible with the 'local
• found a '%s' artifact, which is incompatible with the 'clust
• `apply` requires at least one manifest argument
• `exec` requires exactly one action to execute
• `config-dependencies add` requires exactly one file path arg

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/65e4573b478c9917. Report an issue: GitHub.