sealed-secrets: Bug in regards to "cannot fetch certificate: no endpoints available for service "http:sealed-secrets-controller:"

Hi everyone!

Thanks so much for reporting this! The changes we recently introduced at https://github.com/bitnami-labs/sealed-secrets/pull/690 (introducing a name for the http port exposed in the service) broke the compatibility with kubeseal.

This should be fixed by this PR: https://github.com/bitnami-labs/sealed-secrets/pull/648

In the meantime, you can workaround this by removing the name and setting targetPort: 8080 as @glitchcrab pointed out at https://github.com/bitnami-labs/sealed-secrets/issues/694#issuecomment-997370679.

@Mirdrack This works for me, with chart 2.1.0 and app v0.17.2:

kubeseal --controller-namespace=sealed-secrets           --controller-name=sealed-secrets --fetch-cert

The specs of my service still has http as target port

This is expected.

Have you updated kubeseal?

$ kubeseal --version
kubeseal version: 0.17.2

I just installed kubeseal following the fluxcd documentation.

flux create source helm sealed-secrets --interval=1h --url=https://bitnami-labs.github.io/sealed-secrets
flux create helmrelease sealed-secrets --interval=1h --release-name=sealed-secrets-controller --target-namespace=flux-system --source=HelmRepository/sealed-secrets --chart=sealed-secrets --chart-version=">=1.15.0-0" --crds=CreateReplace

This used the 2.6.0 version of the chart and 0.18.1 of the application.

I also just installed version 0.18.1 of the kubeseal CLI.

I’m still getting the timeout error.

$ kubeseal --fetch-cert --controller-name=sealed-secrets-controller --controller-namespace=flux-system
error: cannot fetch certificate: error trying to reach service: dial tcp 100.96.1.94:8080: i/o timeout

I can port forward the service and retrieve the certificate.

That should be automatically done in a few hours @davidkarlsen

There’s a bot (https://github.com/BrewTestBot) that usually does the magic for us updating this homebrew formula: https://github.com/Homebrew/homebrew-core/blob/master/Formula/kubeseal.rb

Are you on civo.com or with a different Kubernetes service?

Sorry, forgot to mention. AWS EKS 1.21.5.

In my case same Helm chart: bitnami-labs works fine on Rancher RKE on prem clusters and not on cloud.

Same Helm, with same values (deployed as HelmRelease via Flux)

In the the sealed-secrets-controller svc there is no port name by default. Tried to add/remove & change it manually by editing the svc which didn’t help.

In the Helm values (of the working on prem clusters) I set the values:

  values:
    fullnameOverride: sealed-secrets-controller

but with and without this value it fails in cloud (civo + Digital Ocean) with error:

when running kubeseal command:

kubeseal -o yaml < civo-secret.yaml >  civo-sealed-secret.yaml

error: cannot fetch certificate: error trying to reach service: dial tcp 10.42.0.7:8080: i/o timeout

Again, exact same Helm works On prem

Helm values:

apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: sealed-secrets
  namespace: kube-system
spec:
  releaseName: sealed-secrets
  chart:
    spec:
      chart: sealed-secrets
      version: "1.16.1"
      sourceRef:
        kind: HelmRepository
        name: sealed-secrets
        namespace: flux-system
  interval: 10m
  values:
    fullnameOverride: sealed-secrets-controller
    commandArgs:
      - "--update-status"
    crd:
      # crd.create: `true` if the crd resources should be created
      create: true
      # crd.keep: `true` if the sealed secret CRD should be kept when the chart is deleted
      keep: true

Service

kubectl get svc/sealed-secrets-controller -n kube-system -o yaml

apiVersion: v1
kind: Service
metadata:
  annotations:
    meta.helm.sh/release-name: sealed-secrets
    meta.helm.sh/release-namespace: kube-system
  creationTimestamp: "2021-11-01T13:48:16Z"
  labels:
    app.kubernetes.io/instance: sealed-secrets
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: sealed-secrets
    app.kubernetes.io/version: v0.16.0
    helm.sh/chart: sealed-secrets-1.16.1
    helm.toolkit.fluxcd.io/name: sealed-secrets
    helm.toolkit.fluxcd.io/namespace: kube-system
  name: sealed-secrets-controller
  namespace: kube-system
  resourceVersion: "22220"
  uid: c5158d18-16be-4394-9204-ff4e0cf9adaa
spec:
  clusterIP: 10.43.225.37
  clusterIPs:
  - 10.43.225.37
  ports:
  - port: 8080
    protocol: TCP
    targetPort: 8080
  selector:
    app.kubernetes.io/name: sealed-secrets
  sessionAffinity: None
  type: ClusterIP
status:
  loadBalancer: {}