airbytehq / airbytehq/airbyte

[Helm 2.0.19] Secret mismatch: dataplane credentials created in airbyte-auth-secrets but expected in airbyte-airbyte-secrets

Offen
#69,834 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
area/platform autoteam community needs-triage team/compose team/platform-move type/bug
Vorherrschende Sprache
Python
Sterne
22.1k
Forks
5.3k
PR-Merge-Kennzahlen
PR-Kennzahlen ausstehend

Beschreibung

### Helm Chart Version

2.0.19

### What step the error happened?

On deploy

### Relevant information

## Environment
- **Helm Chart Version**: 2.0.19 (latest)
- **App Version**: 2.0.1
- **Kubernetes**: GKE
- **Deployment**: Fresh install via OpenTofu

## Problem Description

The Airbyte Helm chart creates `dataplane-client-id` and `dataplane-client-secret` in the `airbyte-auth-secrets` Secret, but the `workload-launcher` component expects these credentials in the `airbyte-airbyte-secrets` Secret. This causes `workload-launcher` to fail with `CreateContainerConfigError`.

This is a **secret management inconsistency** in the Helm chart where different components look for credentials in different secrets.

## Steps to Reproduce

1. Deploy Airbyte using Helm chart version 2.0.19:
```bash
helm repo add airbytehq https://airbytehq.github.io/charts
helm repo update
helm install airbyte airbytehq/airbyte --version 2.0.19 -n airbyte --create-namespace
```

2. Wait for pods to start

3. Observe `workload-launcher` pod status:
```bash
kubectl get pods -n airbyte -l app.kubernetes.io/name=workload-launcher
```

## Expected Behavior

All Airbyte components, including `workload-launcher`, should start successfully and find the dataplane credentials in the expected secret location.

## Actual Behavior

The `workload-launcher` pod fails with `CreateContainerConfigError`:

```
NAME READY STATUS RESTARTS AGE
airbyte-workload-launcher-569cb58577-5t976 0/1 CreateContainerConfigError 0 9s
```

### Error from kubectl describe pod:
```
Events:
Warning Failed 5s (x8 over 80s) kubelet Error: couldn't find key dataplane-client-id in Secret airbyte/airbyte-airbyte-secrets
```

The pod cannot start because Kubernetes cannot find the required secret key when trying to mount environment variables.

## Root Cause Analysis

### Secret Created by Helm Chart:
```bash
kubectl get secret airbyte-auth-secrets -n airbyte -o jsonpath='{.data}' | jq 'keys'
```

Output:
```json
[
"dataplane-client-id",
"dataplane-client-secret",
...
]
```

### Secret Expected by workload-launcher:
The component looks in `airbyte-airbyte-secrets` for these keys, but they don't exist there.

```bash
kubectl get secret airbyte-airbyte-secrets -n airbyte -o jsonpath='{.data}' | jq 'keys'
```

Output (missing dataplane credentials):
```json
[
"DATABASE_PASSWORD",
"DATABASE_USER",
...
# dataplane-client-id NOT HERE
# dataplane-client-secret NOT HERE
]
```

## Verification After Manual Fix

After manually copying the credentials to the correct secret:

```bash
# Extract from airbyte-auth-secrets and patch into airbyte-airbyte-secrets
kubectl patch secret airbyte-airbyte-secrets -n airbyte --type='json' -p="[
{\"op\": \"add\", \"path\": \"/data/dataplane-client-id\", \"value\": \"...\"},
{\"op\": \"add\", \"path\": \"/data/dataplane-client-secret\", \"value\": \"...\"}
]"
```

### After Fix - All Pods Healthy:
```
NAME READY STATUS RESTARTS AGE
airbyte-server-b6687c7cb-mhrfd 1/1 Running 1 (2m58s ago) 4m51s
airbyte-worker-57b796cd6b-b4f2v 1/1 Running 1 (3m49s ago) 4m51s
airbyte-workload-launcher-569cb58577-t8v9t 1/1 Running 2 (100s ago) 2m53s
```

### Verified Secret Now Contains Both:
```bash
kubectl get secret airbyte-airbyte-secrets -n airbyte -o jsonpath='{.data}' | jq 'keys'
```

Output:
```json
[
"DATABASE_PASSWORD",
"DATABASE_USER",
"DATAPLANE_CLIENT_ID",
"DATAPLANE_CLIENT_SECRET",
"dataplane-client-id", ← Now present
"dataplane-client-secret" ← Now present
]
```

### Relevant log output

```shell

```

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.