I am using Amazon EKS.
When I try to use Sealed Secrets to seal my secret by:
cat my-secret.unsealed.yaml |
kubeseal
--controller-namespace=production-sealed-secrets
--controller-name=sealed-secrets
--format=yaml
> my-secret.yaml
I got error
error: cannot fetch certificate: error trying to reach service: dial tcp 172.31.13.104:8080: connect: connection timed out
In my case, my Amazon EKS is provisioned by terraform-aws-modules,
kubeseal is using port 8080.
After updating my node security policy to allow connection from port 8080, kubeseal can work properly.
module "eks" {
source = "terraform-aws-modules/eks/aws"
# ...
node_security_group_additional_rules = {
# For kubeseal
ingress_8080 = {
type = "ingress"
protocol = "tcp"
from_port = 8080
to_port = 8080
source_cluster_security_group = true
}
}
}
Reference: https://github.com/bitnami-labs/sealed-secrets/issues/699#issuecomment-1053971055