-
Notifications
You must be signed in to change notification settings - Fork 672
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Cannot fetch certificate: no endpoints available for service "http:sealed-secrets-controller:" #694
Comments
Same issue here |
Also seeing the same problem after upgrading to the latest version. Manually removing the |
Same issue here after helm upgrade. Thanks @glitchcrab for the workaround, it made the trick for a quick patch. |
Same here anyone tried downgrading? |
Hi everyone! Thanks so much for reporting this! The changes we recently introduced at #690 (introducing a name for the http port exposed in the service) broke the compatibility with kubeseal. This should be fixed by this PR: #648 In the meantime, you can workaround this by removing the |
I've downgraded helm release to |
Hi @demisx, can confirm |
…p:sealed-secrets-controller:" See also https://istio.io/latest/docs/ops/configuration/traffic-management/protocol-selection/#explicit-protocol-selection Fixes: bitnami-labs#502 Fixes: bitnami-labs#694
To easily apply the aforementioned fix to the service:
|
If you're using the prom servicemonitor in the chart don't forget to update this after patching the service. I.e
|
Hi everyone! I’m glad to announce that we just released a new version of Sealed Secrets that address this issue: |
@juan131 I have v0.17.2 installed and still having the same error: |
@cdenneen are you using |
Just a FYI: In the current project I am working, we switched to "offline" sealing. Means we fetch the public certs and use this in the kubeseal commmand! So much better, as we don't need to handle the kubeconfig stuff, and can share the key with the Team! Back to topic: the version |
@juan131 I had old version of |
I am facing another related issue on the latest version v0.18.2. I'm using this version on both the controller and the kubeseal Output of this cmd after kubectl proxy is
Controller.yml service :
Any idea on what I'm missing or doing wrong here? |
Hi @emenylouu, I installed helm install sealed-secrets -n kube-system --set-string fullnameOverride=sealed-secrets-controller --version 2.6.1 sealed-secrets/sealed-secrets
NAME: sealed-secrets
LAST DEPLOYED: Mon Sep 5 12:36:23 2022
NAMESPACE: kube-system
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
** Please be patient while the chart is being deployed **
You should now be able to create sealed secrets.
1. Install the client-side tool (kubeseal) as explained in the docs below:
https://github.com/bitnami-labs/sealed-secrets#installation-from-source
2. Create a sealed secret file running the command below:
kubectl create secret generic secret-name --dry-run=client --from-literal=foo=bar -o [json|yaml] | \
kubeseal \
--controller-name=sealed-secrets-controller \
--controller-namespace=kube-system \
--format yaml > mysealedsecret.[json|yaml]
The file mysealedsecret.[json|yaml] is a commitable file.
If you would rather not need access to the cluster to generate the sealed secret you can run:
kubeseal \
--controller-name=sealed-secrets-controller \
--controller-namespace=kube-system \
--fetch-cert > mycert.pem
to retrieve the public cert used for encryption and store it locally. You can then run 'kubeseal --cert mycert.pem' instead to use the local cert e.g.
kubectl create secret generic secret-name --dry-run=client --from-literal=foo=bar -o [json|yaml] | \
kubeseal \
--controller-name=sealed-secrets-controller \
--controller-namespace=kube-system \
--format [json|yaml] --cert mycert.pem > mysealedsecret.[json|yaml]
3. Apply the sealed secret
kubectl create -f mysealedsecret.[json|yaml]
Running 'kubectl get secret secret-name -o [json|yaml]' will show the decrypted secret that was generated from the sealed secret.
Both the SealedSecret and generated Secret must have the same name and namespace.
on ⛵ docker-desktop on docker-desktop in docker-desktop ()civogo on master [!⇡] via 🐹 v1.19 took 3s
❯ kubeseal --fetch-cert -n kube-system
-----BEGIN CERTIFICATE-----
MIIEzDCCArSgAwIBAgIQPHJbXfIvad2JL0Xb5cXw9jANBgkqhkiG9w0BAQsFADAA
MB4XDTIyMDkwNTEwMzIzM1oXDTMyMDkwMjEwMzIzM1owADCCAiIwDQYJKoZIhvcN
AQEBBQADggIPADCCAgoCggIBAO0tcugE2TAMA/9V2l/03ykfbyQsLXpnJNmdJ6Np
RrbjK6VKAtIRgaw7cHF1eznkJpIy9yxsGjavrAFSO4mEtR94L8wYpBKRfe06wLMg
CKajkapU18X3ldatITdLAZj2p9bCxGv+5/pF97a5rtS/h1ofOOMLtcHOJnjkzxMG
tOGGWngc2hfp0ruO1LyS+R8TqDDARiLW+aTMXIuaguEIQ9aq40Asg6uprIkJ7Jp6
X+QwvLHL9PI6NIoDNtwukTH9kfqmduYFoalMkILFzqKL7HwY1796Qq6FY2GD/RtF
27vAI+Akn5qf1VWRVSeuVxA8qYhZkElXI3Q7vbbP/gJgVc49wpMfTC7TFs0+cdAx
mvy5ooiXuHZwwoKEHMAM8Io+cU4eSypgFwQD1EMQclhDdbiSWJ9sZUBO+h5F8Wq8
TlemMffyhdMMIbwU/oNKGEkR9RhnLhQyNejIrOpYZ4HcGdYxhR0ErYzylTiE1bmc
03iUY3y2Zi6ic8C4etv4T3LeEynd+icSZrAxZU09JnAQAuvonTOQ+RF4S+tsq29w
3VeBvBotlXsZVvJWtvrqlaGCrMeCNhO8EWDkYVbOCoq+96cMEOCiOe/NFgL42ztA
Sw4Z9lD2dTme3LehFge3pq+jLza6J2Zf1Xe/WZvPOl91lnw6MofQI8v/YMwNzXE6
tLKjAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIAATAPBgNVHRMBAf8EBTADAQH/MB0G
A1UdDgQWBBRVwr/zCuwZ79ydHZbJyMttT/CdhzANBgkqhkiG9w0BAQsFAAOCAgEA
s09KWlMfzCNKs6/+cjt5Yv7JVuZdJSVc0IHfja3av8O/y5wmli1wF+M0uH9VJeGO
+hXNcppqUfkCEMNen82pMZoYIajh9bwhQTXbfJyc9qqJWHo0zJinMqxDjY3ENOGw
wLbAVJFGdYQvbpXKxU/yYXQJvYkKgM5G6BlSflqpcV9uuLUZ3vV14v2DHiZJP6ej
emoIipiA0hxyAUWoeO9iPMDIaaUqBDqsyYGCnQ7+jEVZ1RyPA6ZaumO4e9kX5N/+
kL9N7zk+NEnJh+tUNQKRApfZnYwgi1FxxFfJ66HzLFc1zq+bPAC3VG0MOba73rgi
OsFd97Lg8ONu0f6gLqfC+B02BsmLAi0/vx9cJpF5AilS3f0VRSGSkHI6Rwl9wRsk
pydi1Tdn2RiWO2TJIVfh4hpj+c2M8dSIU42mMwnMi95swYYMOPtt0WYZ1odpMMVP
1SS14zWHk+xzneQnPcbCtvvJ/D6e4maWDSTnKu7V8AhONtWLvDzdMza7sGD7q/Dv
v3FUTLZ0GHFSOODmFhfAqBfhB28EHPbvL+nrnfeSzUnFqc/byEOQ2OYbns9g5Yro
REK9xkZF5+09uAxIZVFfNZAxEpsEQXPe409Lmu+FfnV5hVLhmw//1Ct/yhCzeyeM
JMdmzhCaNXJdScaWEGy6vZcqTIAhYziIMPoXXhUHCFY=
-----END CERTIFICATE----- Would need more input from you regarding the way you installed. Check maybe the endpoints? ❯ k get endpoints -n kube-system
NAME ENDPOINTS AGE
docker.io-hostpath <none> 46d
kube-dns 10.1.2.202:53,10.1.2.203:53,10.1.2.202:53 + 3 more... 46d
sealed-secrets-controller 10.1.2.205:8080 2m52s And the endpoint itself: k get endpoints sealed-secrets-controller -o yaml -n kube-system
apiVersion: v1
kind: Endpoints
metadata:
annotations:
endpoints.kubernetes.io/last-change-trigger-time: "2022-09-05T10:36:29Z"
creationTimestamp: "2022-09-05T10:36:23Z"
labels:
app.kubernetes.io/instance: sealed-secrets
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: sealed-secrets
app.kubernetes.io/version: v0.18.2
helm.sh/chart: sealed-secrets-2.6.1
name: sealed-secrets-controller
namespace: kube-system
resourceVersion: "44162"
uid: ffe04034-42fe-4559-9fdc-4163f6540bac
subsets:
- addresses:
- ip: 10.1.2.205
nodeName: docker-desktop
targetRef:
kind: Pod
name: sealed-secrets-controller-68dd8fb447-xvwh9
namespace: kube-system
uid: 3863e0e7-07e2-4dd9-ad3e-44284011c2a8
ports:
- name: http
port: 8080
protocol: TCP Hope it helps to solve the issue. |
Thanks for sharing all the info and steps @dirien!! after multiple attempts, I tested the configuration and came to the conclusion that sealed-secret-controller only runs in kube-system namespace as a part of the cluster configuration. what I was trying to do is to install it on another namespace where my secret is. I haven't seen any official documentation around this though, but I've seen another github thread that recommends this. |
Hello!
We've installed the latest sealed-secrets via helm charts and noticed an issue when trying to use kubseal.
After digging a bit deeper i uncovered a PR that was merged that fixed this exact issue, but it doesn't look like it's made its way into this repo:
helm/charts#22097
This can be checked by running:
If you add the http protocol for port it works: curl http://127.0.0.1:8001/api/v1/namespaces/kube-system/services/http:sealed-secrets-controller:http/proxy/v1/cert.pem
The text was updated successfully, but these errors were encountered: