Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rotate KMS key cause cluster stuck in updating status #291

Open
RichardChen820 opened this issue Sep 7, 2023 · 1 comment
Open

Rotate KMS key cause cluster stuck in updating status #291

RichardChen820 opened this issue Sep 7, 2023 · 1 comment
Labels
bug Something isn't working

Comments

@RichardChen820
Copy link

Describe the bug
We are planning to use KMS v2 to encrypt secret data at rest on our production AKS cluster, When I doing the testing, I just found that rotating KMS key causes the cluster stuck in updating status.

Steps To Reproduce

  1. Enable KMS v2 with key version#1, and update the existing secret to be replaced as encrypted data
  2. Create a key version#2 and update keyID of KMS plugin to use version#2, but do NOT re-encrypt the secret
  3. Create a key version#3 and update keyID of KMS plugin to use version#3
  4. See cluster stuck in updating status

KMS Plugin for Key Vault version
Default version on AKS v1.27.3

Kubernetes version
AKS v1.27.3

Additional context

@RichardChen820 RichardChen820 added the bug Something isn't working label Sep 7, 2023
@RichardChen820
Copy link
Author

Update command used in repro step 2 and 3

az aks update --name $mycluster--resource-group $myRG --enable-azure-keyvault-kms --azure-keyvault-kms-key-vault-network-access "Public" --azure-keyvault-kms-key-id $keyVaultKeyId

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant