{"record":{"id":"65e4573b478c9917","repo":"GoogleContainerTools/skaffold","slug":"unable-to-expand-pullsecretpath-s","errorCode":null,"errorMessage":"unable to expand pullSecretPath %s","messagePattern":"unable to expand pullSecretPath (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/schema/defaults/defaults.go","lineNumber":339,"sourceCode":"\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting current namespace: %w\", err)\n\t\t}\n\t\tcluster.Namespace = ns\n\t}\n\treturn nil\n}\n\nfunc setDefaultClusterTimeout(cluster *latest.ClusterDetails) error {\n\tcluster.Timeout = valueOrDefault(cluster.Timeout, kaniko.DefaultTimeout)\n\treturn nil\n}\n\nfunc setDefaultClusterPullSecret(cluster *latest.ClusterDetails) error {\n\tcluster.PullSecretMountPath = valueOrDefault(cluster.PullSecretMountPath, kaniko.DefaultSecretMountPath)\n\tif cluster.PullSecretPath != \"\" {\n\t\tabsPath, err := homedir.Expand(cluster.PullSecretPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to expand pullSecretPath %s\", cluster.PullSecretPath)\n\t\t}\n\t\tcluster.PullSecretPath = absPath\n\t\trandom := \"\"\n\t\tif cluster.RandomPullSecret {\n\t\t\tuid, _ := uuid.NewUUID()\n\t\t\trandom = uid.String()\n\t\t}\n\t\tcluster.PullSecretName = valueOrDefault(cluster.PullSecretName, kaniko.DefaultSecretName+random)\n\t\treturn nil\n\t}\n\treturn nil\n}\n\nfunc setDefaultClusterDockerConfigSecret(cluster *latest.ClusterDetails) error {\n\tif cluster.DockerConfig == nil {\n\t\treturn nil\n\t}\n","sourceCodeStart":321,"sourceCodeEnd":357,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/schema/defaults/defaults.go#L321-L357","documentation":"setDefaultClusterPullSecret expands the configured kaniko pullSecretPath to an absolute path using homedir.Expand. If expansion fails (malformed path, e.g. invalid '~' usage), the error names the offending path and aborts defaults processing — note it deliberately discards the underlying error.","triggerScenarios":"Calling setDefaultClusterPullSecret when cluster.PullSecretPath is non-empty and homedir.Expand(cluster.PullSecretPath) returns an error — typically a path starting with '~' that cannot be resolved to a home directory (no HOME set) or an invalid path expression.","commonSituations":"pullSecretPath like \"~/secret.json\" in a container/CI where $HOME is unset, a malformed tilde path, or pull-secret config copied from another environment with a nonexistent home layout.","solutions":["Set cluster.PullSecretPath to an absolute path (e.g. /secrets/pull-secret.json)","Ensure $HOME is set in the environment if using '~'-prefixed paths","Remove the pullSecretPath entry if not needed","Check for typos in the tilde expansion (e.g. '~user' forms unsupported in the runtime env)"],"exampleFix":"# before\ndeploy:\n  kubectl:\n    clusters:\n      - pullSecretPath: ~/kaniko-secret.json\n# after (absolute path, no $HOME dependency)\ndeploy:\n  kubectl:\n    clusters:\n      - pullSecretPath: /secrets/kaniko-secret.json","handlingStrategy":"validation","validationCode":"if strings.HasPrefix(cluster.PullSecretPath, \"~\") && os.Getenv(\"HOME\") == \"\" {\n    return errors.New(\"pullSecretPath uses '~' but HOME is unset; use an absolute path\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Prefer absolute paths over '~'-prefixed paths in cluster configs","Ensure HOME is exported in containers/CI running skaffold","Audit kaniko pullSecretPath entries when moving configs between environments"],"tags":["skaffold","kaniko","pull-secret","path-expansion"],"backgroundTag":"path-expansion-failed","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}