bitnami / bitnami/sealed-secrets

Secrets are not being created for different namespaces

Open
#622 7 comments 0 reactions 0 assignees View on GitHub
backlog bug
Dominant language
Go
Stars
9.3k
Forks
776
Avg merge
1d 13h
Merged PRs (30d)
30

Description

# Explanation
I want to store my database credentials in sealed secret files.
I'm trying to have sealed secrets for each namespace (dev, dev1).
I'm using `skaffold` and `kustomize` to deploy to my remote k8s cluster.

## 1º Install the controller inside cluster for each namespace

I run the commands:

Path: `overlays/dev`
```bash
kubectl apply --filename controller-dev.yml
```

Path: `overlays/dev1`
```bash
kubectl apply --filename controller-dev1.yml
```

Is the same as you run this `kubectl apply --filename https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.16.0/controller.yaml` but with the respective namespaces(`dev`, `dev1`) for each file, instead of `kube-system`

At this point, `sealed-secret-controller` has been created for both namespaces in remote k8s

## 2º Fetch cert

Path: `overlays/dev`
```bash
kubeseal --controller-namespace dev --fetch-cert > cert.pem
```

Path: `overlays/dev1`
```bash
kubeseal --controller-namespace dev1 --fetch-cert > cert.pem
```

At this point, in each path i have a `cert.pem` file.

## 3º Generate sealed secret

Path: `overlays/dev`
```bash
kubeseal < secret-postgres.yml --cert cert.pem -o yaml > sealed-secret-postgres.yml
```

Path: `overlays/dev1`

```bash
kubeseal < secret-postgres.yml --cert cert.pem -o yaml > sealed-secret-postgres.yml
```
At this moment, i have two different `SealedSecret` files, one in each path. The difference is the `namespace` and the encrypted data, although is the same `Key : value` pairs.

## 4º Apply sealed secret for dev namespace

Path: `overlays/dev`
```bash
kubectl apply --filename sealed-secret-postgres.yml
```
Output:
```bash
sealedsecret.bitnami.com/postgres-secret created
```
If i run:
```bash
kubectl get secret -n dev
```
Output:
```bash
NAME TYPE DATA AGE
default-token-gq5vd kubernetes.io/service-account-token 3 154m
postgres-secret Opaque 3 128m
sealed-secrets-controller-token-4stnm kubernetes.io/service-account-token 3 147m
sealed-secrets-keyvpxbc kubernetes.io/tls 2 147m
```

At this point the `postgres-secret` was created and if i output in yaml format i am able to see the data with `key : value` pairs in base 64 encoded.

## 5º Apply sealed secret for dev1 namespace

Path: `overlays/dev1`
```bash
kubectl apply --filename sealed-secret-postgres.yml
```
Output:
```bash
sealedsecret.bitnami.com/postgres-secret configured
```
If i run:
```bash
kubectl get secret -n dev1
```
Output:
```bash
NAME TYPE DATA AGE
default-token-6d2mb kubernetes.io/service-account-token 3 51d
sealed-secrets-controller-token-xrmr2 kubernetes.io/service-account-token 3 120m
sealed-secrets-key7k4w8 kubernetes.io/tls 2 120m
```
**NOTE:** The `postgres-secret` was not created in this namespace

# Expected behavior
Should create a new `postgres-secret` for each namespace, but doesn't, only create for the first namespace.
Both have the same name and data, the only thing that is different is the namespace

# Additional Information
Kubeseal version: v0.16.1-0.20210512081140-62cfb264f53e
Operating system: Pop!_OS 20.04

Contributor guide

Open the contributing guide

Research direction

Start by comparing controller-dev.yml and controller-dev1.yml, then reproduce the kubeseal --controller-namespace and kubectl apply commands for both namespaces. Trace how the sealed-secrets controller handles the two SealedSecret resources and verify that applying each namespaced resource creates postgres-secret in both dev and dev1.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
devops, infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.