Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error when using ArgoCD to decrypt SealedSecret for DockercofigJson #20635

Open
3 tasks done
kratos81 opened this issue Nov 1, 2024 · 0 comments
Open
3 tasks done

Error when using ArgoCD to decrypt SealedSecret for DockercofigJson #20635

kratos81 opened this issue Nov 1, 2024 · 0 comments
Labels
bug Something isn't working component:argocd

Comments

@kratos81
Copy link

kratos81 commented Nov 1, 2024

Checklist:

  • I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
  • I've included steps to reproduce the bug.
  • I've pasted the output of argocd version.

Describe the bug

I am getting an error when trying to use ArgoCD to decrypt a sealed secret for Dockerconfigjson

  • I am using a helm chart to pass in the dockerconfigjson value so that it will be used to create a pullsecret and mounted into a pod.
  • When I pass in the raw yaml into the templates directory it works fine. But when I pass it into the values.yaml file for interpolation I get this error from ArgoCD
ErrUnsealFailed
Failed to unseal: no key could decrypt secret (.dockerconfigjson)
12

I have confirmed the set up for sealedsecret is working fine because other sealed secrets work fine. It is just the dockerconfigjson one that does not decrypt

This is a snippet of the values.yaml file

secret: 
  # If enabled is false, then the template that uses this value will not be deployed
  sslTmplRequired:
    enabled: false
  # To test HELM ARGO CD for repo secret
  testimage_name: robot-pull-secret
  testconfigjson: *****
 
  # repo-metadata-secret.yaml
  imagePullSecrets_name: stage-alfaapi-pull-secret
  dockerconfigjson: ******

And this is the corresponding file in the templates directory it should render

apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  creationTimestamp: null
  name: {{ .Values.secret.imagePullSecrets_name }}
  namespace: {{ .Values.namespace_name }}
spec:
  encryptedData:
    .dockerconfigjson: {{ .Values.secret.dockerconfigjson }}
  template:
    metadata:
      creationTimestamp: null
      name: {{ .Values.secret.imagePullSecrets_name }}
      namespace: {{ .Values.namespace_name }}
    type: kubernetes.io/dockerconfigjson

To Reproduce

  • Create a helm chart ( or use an existing one )
  • Generate a sealed secret with a dockerconfig.json ( using kubeseal )
  • Use the values.yaml to pass in the encrypted value for config.Json
  • Commit and push up to a repo monitored by argocd
  • Sync with ArgoCD

Expected behavior
ArgoCD will Sync with no issues. The sealed secret should create the corresponding secret

Screenshots

Version

 argocd version
argocd: v2.5.5+fc3eaec
  BuildDate: 2022-12-16T16:34:36Z
  GitCommit: fc3eaec6f498ddbe49a5fa9d215a219191fba02f
  GitTreeState: clean
  GoVersion: go1.18.9
  Compiler: gc
  Platform: linux/amd64
WARN[0000] Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web.
argocd-server: v2.12.0+ec30a48

Logs

Paste any relevant application logs here.
@kratos81 kratos81 added the bug Something isn't working label Nov 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working component:argocd
Projects
None yet
Development

No branches or pull requests

2 participants