[Helm 2.0.19] Secret mismatch: dataplane credentials created in airbyte-auth-secrets but expected in airbyte-airbyte-secrets
- Vorherrschende Sprache
- Python
- Sterne
- 22.1k
- Forks
- 5.3k
- PR-Merge-Kennzahlen
- PR-Kennzahlen ausstehend
Beschreibung
### Helm Chart Version
2.0.19
### What step the error happened?
On deploy
### Relevant information
## Environment
- **Helm Chart Version**: 2.0.19 (latest)
- **App Version**: 2.0.1
- **Kubernetes**: GKE
- **Deployment**: Fresh install via OpenTofu
## Problem Description
The Airbyte Helm chart creates `dataplane-client-id` and `dataplane-client-secret` in the `airbyte-auth-secrets` Secret, but the `workload-launcher` component expects these credentials in the `airbyte-airbyte-secrets` Secret. This causes `workload-launcher` to fail with `CreateContainerConfigError`.
This is a **secret management inconsistency** in the Helm chart where different components look for credentials in different secrets.
## Steps to Reproduce
1. Deploy Airbyte using Helm chart version 2.0.19:
```bash
helm repo add airbytehq https://airbytehq.github.io/charts
helm repo update
helm install airbyte airbytehq/airbyte --version 2.0.19 -n airbyte --create-namespace
```
2. Wait for pods to start
3. Observe `workload-launcher` pod status:
```bash
kubectl get pods -n airbyte -l app.kubernetes.io/name=workload-launcher
```
## Expected Behavior
All Airbyte components, including `workload-launcher`, should start successfully and find the dataplane credentials in the expected secret location.
## Actual Behavior
The `workload-launcher` pod fails with `CreateContainerConfigError`:
```
NAME READY STATUS RESTARTS AGE
airbyte-workload-launcher-569cb58577-5t976 0/1 CreateContainerConfigError 0 9s
```
### Error from kubectl describe pod:
```
Events:
Warning Failed 5s (x8 over 80s) kubelet Error: couldn't find key dataplane-client-id in Secret airbyte/airbyte-airbyte-secrets
```
The pod cannot start because Kubernetes cannot find the required secret key when trying to mount environment variables.
## Root Cause Analysis
### Secret Created by Helm Chart:
```bash
kubectl get secret airbyte-auth-secrets -n airbyte -o jsonpath='{.data}' | jq 'keys'
```
Output:
```json
[
"dataplane-client-id",
"dataplane-client-secret",
...
]
```
### Secret Expected by workload-launcher:
The component looks in `airbyte-airbyte-secrets` for these keys, but they don't exist there.
```bash
kubectl get secret airbyte-airbyte-secrets -n airbyte -o jsonpath='{.data}' | jq 'keys'
```
Output (missing dataplane credentials):
```json
[
"DATABASE_PASSWORD",
"DATABASE_USER",
...
# dataplane-client-id NOT HERE
# dataplane-client-secret NOT HERE
]
```
## Verification After Manual Fix
After manually copying the credentials to the correct secret:
```bash
# Extract from airbyte-auth-secrets and patch into airbyte-airbyte-secrets
kubectl patch secret airbyte-airbyte-secrets -n airbyte --type='json' -p="[
{\"op\": \"add\", \"path\": \"/data/dataplane-client-id\", \"value\": \"...\"},
{\"op\": \"add\", \"path\": \"/data/dataplane-client-secret\", \"value\": \"...\"}
]"
```
### After Fix - All Pods Healthy:
```
NAME READY STATUS RESTARTS AGE
airbyte-server-b6687c7cb-mhrfd 1/1 Running 1 (2m58s ago) 4m51s
airbyte-worker-57b796cd6b-b4f2v 1/1 Running 1 (3m49s ago) 4m51s
airbyte-workload-launcher-569cb58577-t8v9t 1/1 Running 2 (100s ago) 2m53s
```
### Verified Secret Now Contains Both:
```bash
kubectl get secret airbyte-airbyte-secrets -n airbyte -o jsonpath='{.data}' | jq 'keys'
```
Output:
```json
[
"DATABASE_PASSWORD",
"DATABASE_USER",
"DATAPLANE_CLIENT_ID",
"DATAPLANE_CLIENT_SECRET",
"dataplane-client-id", ← Now present
"dataplane-client-secret" ← Now present
]
```
### Relevant log output
```shell
```
Beitragsleitfaden
Bewertung
Dieses Issue wurde noch nicht bewertet.