https://fabian.run/tags/k8s/ Recent content in K8s on fabian.run Hugo en Tue, 01 Nov 2022 10:49:06 +0200 https://fabian.run/posts/til_sealed_secret_namespaces/ Tue, 01 Nov 2022 10:49:06 +0200 https://fabian.run/posts/til_sealed_secret_namespaces/ <p>When using the bitnami sealed secrets controller<sup id="fnref:1"><a href="#fn:1" class="footnote-ref" role="doc-noteref">1</a></sup> in your kubernetes cluster you explicitly have to set the namespace of your secret before generating the SealedSecret <code>.yaml</code>.</p> <p>When you omit the namespace metadata <code>namespace: default</code> will be added by the <code>kubeseal</code> cli and the controller will then not be able to decrypt the secret into your actual namespace. You will get the error message: <code>no key could decrypt secret</code>.</p> <p>The namespace is part of the encryption to prevent that someone just decrypts the secret into another namespace with different access rights and then will be able to read the contents of the decrypted secret there<sup id="fnref:2"><a href="#fn:2" class="footnote-ref" role="doc-noteref">2</a></sup>.</p>