## TL;DR
GitHub Actions secrets cap at 64KB; anything bigger (kubeconfigs with certs, large JSON keys) gets rejected at save time. Store the blob in external storage (cloud object store or a secret manager) and keep only the pointer or access credentials in the Action secret. The workflow fetches the blob at runtime.

## Error
```text
github actions: secret exceeds 64kb limit error
```

## Steps
1. Measure the blob: check the byte size of the value you are trying to save. Expected: confirmation it exceeds 65536 bytes, not a different save error.
2. Move the blob to external storage: upload it to a cloud object store with tight access controls, or store it in a real secret manager. Expected: the blob lives somewhere built for large secrets.
3. Save only the pointer in GitHub: store the object path plus the minimal credentials needed to fetch it (or use OIDC to avoid credentials entirely). Expected: the secret saves because it is now tiny.
4. Fetch at runtime: add a workflow step that downloads the blob to the runner before the step that needs it. Expected: the job has the full value in the workspace without GitHub ever storing it.
5. If the blob is only slightly over, consider splitting it across multiple secrets and reassembling in the job. Expected: each piece stays under the limit; prefer external storage for anything much larger.

## When to use
- Saving a GitHub Actions secret fails with the 64KB limit
- Large kubeconfigs, service-account JSON files, or certificates need to reach a workflow
- Designing secret storage for a new pipeline

## When not to use
- Secrets that save fine but are not injected (different problem)
- Organization or environment secret scoping issues

## Tool compatibility
- GitHub Actions secrets (repository, environment, organization); cloud object stores, secret managers

## Variant phrasings
### github secret too large to save
The 64KB cap is per secret; external storage plus a pointer is the supported pattern.

### store kubeconfig for github actions
Keep the kubeconfig in a secret manager and fetch it at runtime rather than pasting 100KB into a GitHub secret.

## Why it happens
GitHub sizes Actions secrets for tokens and passwords, not multi-kilobyte blobs. The 64KB cap protects the secrets infrastructure, so large values belong in systems designed for them, with GitHub holding only the access path.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_yd8XGA7hltnhncgU9xteRA