sealed-secrets: "crypto/rsa: decryption error" when combining several SealedSecrets into one ?
I’d like to combine several (sealed) secrets into one.
Since the values are now encrypted individually, I naively thought that all it would take would be to copy/paste the key/encrypted value pairs in the existing SealedSecrets’ encryptedData and make a new one from that ? It doesn’t seem to work :
2018/09/04 16:00:22 Error updating test/external-services-credentials, will retry: crypto/rsa: decryption error
2018/09/04 16:00:22 Updating test/external-services-credentials
2018/09/04 16:00:22 Error updating test/external-services-credentials, will retry: crypto/rsa: decryption error
2018/09/04 16:00:22 Updating test/external-services-credentials
2018/09/04 16:00:22 Error updating test/external-services-credentials, will retry: crypto/rsa: decryption error
2018/09/04 16:00:22 Updating test/external-services-credentials
2018/09/04 16:00:22 Error updating test/external-services-credentials, will retry: crypto/rsa: decryption error
2018/09/04 16:00:22 Updating test/external-services-credentials
2018/09/04 16:00:22 Error updating test/external-services-credentials, will retry: crypto/rsa: decryption error
2018/09/04 16:00:22 Updating test/external-services-credentials
2018/09/04 16:00:22 Error updating test/external-services-credentials, giving up: crypto/rsa: decryption error
E0904 16:00:22.589255 1 controller.go:156] crypto/rsa: decryption error
Is the encrypted data somehow tied to the original metadata.name, or anything like that which would prevent me to do what I’m trying to do ?
Thanks
About this issue
- Original URL
- State: closed
- Created 6 years ago
- Reactions: 1
- Comments: 20 (4 by maintainers)
It’s namespace+name because that matches the level that can be described with RBAC policies. We could certainly invent a namespace-only variation, as is described in #89.
@renaudguerin: I tried to call out the fact that the SealedSecret is tied to a specific namespace+name in the README.md, with some mention of the attack that this protects against. Patches to the docs would be gratefully accepted if there’s something we can add that would have made this clearer for you.
(See also this old related comment)