bitnami / bitnami/sealed-secrets

Broken SealedSecret causes failure in processing

Open
#505 10 comments 10 reactions 0 assignees View on GitHub
backlog enhancement
Dominant language
Go
Stars
9.3k
Forks
776
Avg merge
1d 13h
Merged PRs (30d)
30

Description

We had an individual accidentally upload a broken sealed secret to the cluster (it's not quite obvious what was wrong with it); it appears that, once this secret was considered by the sealed-secrets operator the operator failed and stopped processing other items.

Here's the error message that was printed about once a second:

```
E0121 18:14:24.255540 1 reflector.go:123] github.com/bitnami-labs/sealed-secrets/cmd/controller/controller.go:164: \
Failed to list *v1alpha1.SealedSecret: v1alpha1.SealedSecretList.Items: \
[]v1alpha1.SealedSecret: v1alpha1.SealedSecret.Spec: v1alpha1.SealedSecretSpec.EncryptedData: \
ReadString: expects " or n, but found {, error found in #10 byte of \
...|etadata":{"name":"ju|..., bigger context ...|ec":{"encryptedData":{"kind":"Secret","metadata":{"name":"jupyter-hub-cookies"},"proxy.token":"AgBa1|...
```

(line breaks added for readability). Note the original YAML version of the object looked fine but something in the JSON representation went awry it seems.

Once this particular object was fixed the operator continued on to process everything successfully.

Contributor guide

Open the contributing guide

Research direction

Start at cmd/controller/controller.go:164 and reproduce the malformed SealedSecret processing described in the error. Investigate why an invalid object stops the operator from processing other items, then verify that subsequent objects continue to be processed after the malformed one is encountered.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.