secret was encrypted with newer version error

[networklessons]

I use the latest version of kubesec but see this message when decrypting a secret that I encrypted previously on another machine:

kubesec decrypt secret-oxidixed-id-rsa.pub.yml
It appears that Secret was encrypted with newer version of kubesec.
Visit https://github.com/shyiko/kubesec for upgrade instructions.

I'm using the latest version though:

kubesec --version
0.9.2

I'm using AWS KMS. Any idea how to troubleshoot this?

[shyiko]

Hi.
Check that

1. secret-oxidixed-id-rsa.pub.yml is actually encrypted (it should contain # kubesec:v:4)
2. kubesec --version where you are trying to kubesec decrypt is >= kubesec --version when secret was encrypted.

[networklessons]

Hi,

Thanks for the quick reply, I figured out the issue; it happens when I add the encrypted file to my gitlab repository:

1. Create a new secret.yml file.
2. kubesec encrypt
   --key=aws:arn:aws:kms:us-west-1:000000000000:key/00000000-0000-0000-0000-000000000000 secret.yml
3. commit and push secret.yml to gitlab repository
4. git clone gitlab repository in a new folder
5. kubesec decrypt gives the error.

Something happens with the file, the MD5 hash of the locally created file and git cloned file are different. Not sure what git(lab) does and if this also happens with github.

md5sum secret.yml
fe456c002f07b37edd5234ec7d10ad45 *secret.yml

md5sum secret.yml
cfc92c6bb9ccd7ee21ce2916132ff7d0 *secret.yml

[networklessons]

Here is an example btw:

apiVersion: v1
data:
  id_rsa.pub: c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEMTZ1Ri9LYklSQUVKVVRkSmNyQzduK2ZmazBmWGVrSzhBbnpqU0FTczUxL2hmOTA1VmcrOWZ0b0Z3MmJzQkRKWW1qalJXVVVkSGlQSFNnUFd0WkVPK00xa1g5WVNzNVdaVW03VVFsdklWNnhoVFVVMXlFUHpBVkw0aDYvSnpnSkFack53WUdnSUNxdDJoYktwUGJ1T3BiUmQ0ZmVNSUFZc2JnVjhWRzVrN2RTTWk2UnIyN3lqRlptSWs0cnlXNWw1c2tHTFNnWFh4VFdkOVp3T3RjYVVYeS9NRkZIbGtLZytjU043cGZXRFhuaEU2cGFYb0hQM0lnemlpT1FuMnNXWUlTdGxJcUplUDNLRDdyWVZBanI5a0lFbkNNS1hETzR5Z2E1S3VGdjRIeU96U0FWSzRSZmtwRXJ4U1E5eHowYmJCczJDdER0YWRmNUs0bk5tcjNyZEogamFtZXNAamFtZXM=
kind: Secret
metadata:
  name: secret-oxidized-id-rsa-pub
type: Opaque

When you kubesec encrypt this, commit it to a repo, then pull it to another folder then you can't decrypt it anymore. Perhaps this is a git issue with very long lines?

[shyiko]

Any chance you have .gitattributes with newline normalization? https://help.github.com/en/articles/dealing-with-line-endings

[networklessons]

I don't have one, I did use kubesec on Windows. Should I try it?

[guitarrapc]

I've encounted same issue, and it was caused via EOL.
git commited secrets.enc.yaml was LF, but cloned was CRLF.

I can avoid issue with change file eol to LF and use .gitattributes to specify file EOL.