bitnami / bitnami/sealed-secrets
Secrets are not being created for different namespaces
- Dominant language
- Go
- Stars
- 9.3k
- Forks
- 776
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 30
Description
# Explanation
I want to store my database credentials in sealed secret files.
I'm trying to have sealed secrets for each namespace (dev, dev1).
I'm using `skaffold` and `kustomize` to deploy to my remote k8s cluster.
## 1º Install the controller inside cluster for each namespace
I run the commands:
Path: `overlays/dev`
```bash
kubectl apply --filename controller-dev.yml
```
Path: `overlays/dev1`
```bash
kubectl apply --filename controller-dev1.yml
```
Is the same as you run this `kubectl apply --filename https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.16.0/controller.yaml` but with the respective namespaces(`dev`, `dev1`) for each file, instead of `kube-system`
At this point, `sealed-secret-controller` has been created for both namespaces in remote k8s
## 2º Fetch cert
Path: `overlays/dev`
```bash
kubeseal --controller-namespace dev --fetch-cert > cert.pem
```
Path: `overlays/dev1`
```bash
kubeseal --controller-namespace dev1 --fetch-cert > cert.pem
```
At this point, in each path i have a `cert.pem` file.
## 3º Generate sealed secret
Path: `overlays/dev`
```bash
kubeseal < secret-postgres.yml --cert cert.pem -o yaml > sealed-secret-postgres.yml
```
Path: `overlays/dev1`
```bash
kubeseal < secret-postgres.yml --cert cert.pem -o yaml > sealed-secret-postgres.yml
```
At this moment, i have two different `SealedSecret` files, one in each path. The difference is the `namespace` and the encrypted data, although is the same `Key : value` pairs.
## 4º Apply sealed secret for dev namespace
Path: `overlays/dev`
```bash
kubectl apply --filename sealed-secret-postgres.yml
```
Output:
```bash
sealedsecret.bitnami.com/postgres-secret created
```
If i run:
```bash
kubectl get secret -n dev
```
Output:
```bash
NAME TYPE DATA AGE
default-token-gq5vd kubernetes.io/service-account-token 3 154m
postgres-secret Opaque 3 128m
sealed-secrets-controller-token-4stnm kubernetes.io/service-account-token 3 147m
sealed-secrets-keyvpxbc kubernetes.io/tls 2 147m
```
At this point the `postgres-secret` was created and if i output in yaml format i am able to see the data with `key : value` pairs in base 64 encoded.
## 5º Apply sealed secret for dev1 namespace
Path: `overlays/dev1`
```bash
kubectl apply --filename sealed-secret-postgres.yml
```
Output:
```bash
sealedsecret.bitnami.com/postgres-secret configured
```
If i run:
```bash
kubectl get secret -n dev1
```
Output:
```bash
NAME TYPE DATA AGE
default-token-6d2mb kubernetes.io/service-account-token 3 51d
sealed-secrets-controller-token-xrmr2 kubernetes.io/service-account-token 3 120m
sealed-secrets-key7k4w8 kubernetes.io/tls 2 120m
```
**NOTE:** The `postgres-secret` was not created in this namespace
# Expected behavior
Should create a new `postgres-secret` for each namespace, but doesn't, only create for the first namespace.
Both have the same name and data, the only thing that is different is the namespace
# Additional Information
Kubeseal version: v0.16.1-0.20210512081140-62cfb264f53e
Operating system: Pop!_OS 20.04
Contributor guide
Research direction
Start by comparing controller-dev.yml and controller-dev1.yml, then reproduce the kubeseal --controller-namespace and kubectl apply commands for both namespaces. Trace how the sealed-secrets controller handles the two SealedSecret resources and verify that applying each namespaced resource creates postgres-secret in both dev and dev1.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- devops, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100