./test.sh failing about helm-secrets

[mike10010100]

This is still occurring for sops 3.0.5. Any updates on this?

[nitrogear]

Have the same issue. Can anyone explain how to resolve it?

[stefanthorpe]

@stoyle did you find out what the cause of the issue was? I'm getting the same results.

[stoyle]

No, still failing. But I am using helm-secrets successfully with my own encrypted files. So it works, regardless of this test failure.

[stefanthorpe]

I upgraded sops to 3.0.3 this seemed to help

[stoyle]

Same problem here:

Error: plugin "secrets" exited with error
General error
➜  helm-secrets git:(master) ✗ sops --version
sops 3.0.3 (latest)

helm secrets is working for us, by the way. Just not in this test.

Cheers,
Alf

[caussourd]

I have the same issue (sops 3.0.3)

[marcpalm]

I just tried to get the examples running:

helm secrets dec example/helm_vars/projectX/sandbox/us-east-1/java-app/secrets.yaml
Decrypting example/helm_vars/projectX/sandbox/us-east-1/java-app/secrets.yaml
Error decrypting tree: Error walking tree: Could not decrypt value: crypto/aes: invalid key size 31

Maybe this is related? Btw, helm secrets dec example/helm_vars/secrets.yaml works.

Best, Marc

[yujunz]

Have the same issue when trying the example

helm secrets dec example/helm_vars/projectX/sandbox/us-east-1/java-app/secrets.yaml
Decrypting example/helm_vars/projectX/sandbox/us-east-1/java-app/secrets.yaml
Error decrypting tree: Error walking tree: Could not decrypt value: crypto/aes: invalid key size 31
Error: plugin "secrets" exited with error

• sops 3.0.5 (latest)
• helm-secrets 1.3.1

[tarrall]

Here's a couple more datapoints: the issue happens with plain old sops (not just helm-secrets), and before the upgrade from sops 2.x to sops 3.x, the error wasn't happening:

tarrall@Tarrall <~/gits/helm-secrets>git status
HEAD detached at 98509c7
nothing to commit, working tree clean
tarrall@Tarrall <~/gits/helm-secrets>sops -d example/helm_vars/projectX/production/us-east-1/java-app/secrets.yaml
secret_production_projectx: secret_foo_123
tarrall@Tarrall <~/gits/helm-secrets>git checkout 098df35aabbd4169d0a9569227cef454560e7f86
[...]
tarrall@Tarrall <~/gits/helm-secrets>sops -d example/helm_vars/projectX/production/us-east-1/java-app/secrets.yaml
Error decrypting tree: Error walking tree: Could not decrypt value: crypto/aes: invalid key size 31

Given the timing on that commit, I wonder if it was bitten by getsops/sops#278 ... though mildly surprising that it's not failing for everyone.

If it's that, re-encrypting the examples with a more recent version of sops (e.g. 3.1.1) would be a fix.

[sandywang1982]

Getting the same error with secrets 2.0.0, sops 3.1.1, both are latest.

[jbuettnerbild]

same with sops 3.2.0

[szibis]

@jbuettnerbild @sandywang1982 @stoyle anyone can check if these issues exist on latest 2.0.1 version from the master?

[stoyle]

Looks like it is failing somewhat earlier now. On latest master:

➜  helm-secrets git:(master) sops --version
sops 3.2.0 (latest)
➜  helm-secrets git:(master) ./test.sh
+++ Installing helm-secrets plugin
[OK] helm-secrets plugin installed

+++ Importing private pgp key for projectx
gpg: key AF1D073646ED4927: "helm-secrets-example-projectx <[email protected]>" not changed
gpg: key AF1D073646ED4927: secret key imported
gpg: Total number processed: 1
gpg:              unchanged: 1
gpg:       secret keys read: 1
gpg:  secret keys unchanged: 1

+++ Importing private pgp key for projectx
gpg: key 19F6A67BB1B8DDBE: "helm-secrets-example-projecty <[email protected]>" not changed
gpg: key 19F6A67BB1B8DDBE: secret key imported
gpg: Total number processed: 1
gpg:              unchanged: 1
gpg:       secret keys read: 1
gpg:  secret keys unchanged: 1

+++ Show helm_vars tree from example
example/helm_vars/
├── .sops.yaml
├── projectX
│   ├── .sops.yaml
│   ├── production
│   │   └── us-east-1
│   │       └── java-app
│   │           ├── secrets.yaml
│   │           └── value.yaml
│   └── sandbox
│       └── us-east-1
│           └── java-app
│               ├── secrets.yaml
│               └── value.yaml
├── projectY
│   ├── .sops.yaml
│   ├── production
│   │   └── us-east-1
│   │       └── java-app
│   │           ├── secrets.yaml
│   │           └── value.yaml
│   └── sandbox
│       └── us-east-1
│           └── java-app
│               ├── secrets.yaml
│               └── value.yaml
├── secrets.yaml
└── values.yaml

14 directories, 13 files

+++ Testing ./example/helm_vars/secrets.yaml
+++ Encrypt and Test
[OK] File properly encrypted
+++ Test if 'Already Encrypted' feature works
[FAIL] Not Encrypted or re-encrypted. Should be already encrypted with no re-encryption.
General error

[sandywang1982]

Mine works fine, I have checked out the latest code.

sandy@xxxx:~/helm-secrets$ ./test.sh
+++ Installing helm-secrets plugin
[OK] helm-secrets plugin installed

+++ Importing private pgp key for projectx
gpg: key AF1D073646ED4927: "helm-secrets-example-projectx <[email protected]>" not changed
gpg: key AF1D073646ED4927: secret key imported
gpg: Total number processed: 1
gpg:              unchanged: 1
gpg:       secret keys read: 1
gpg:  secret keys unchanged: 1

+++ Importing private pgp key for projectx
gpg: key 19F6A67BB1B8DDBE: "helm-secrets-example-projecty <[email protected]>" not changed
gpg: key 19F6A67BB1B8DDBE: secret key imported
gpg: Total number processed: 1
gpg:              unchanged: 1
gpg:       secret keys read: 1
gpg:  secret keys unchanged: 1

+++ Show helm_vars tree from example
example/helm_vars/
├── .sops.yaml
├── projectX
│   ├── .sops.yaml
│   ├── production
│   │   └── us-east-1
│   │       └── java-app
│   │           ├── secrets.yaml
│   │           └── value.yaml
│   └── sandbox
│       └── us-east-1
│           └── java-app
│               ├── secrets.yaml
│               └── value.yaml
├── projectY
│   ├── .sops.yaml
│   ├── production
│   │   └── us-east-1
│   │       └── java-app
│   │           ├── secrets.yaml
│   │           └── value.yaml
│   └── sandbox
│       └── us-east-1
│           └── java-app
│               ├── secrets.yaml
│               └── value.yaml
├── secrets.yaml
└── values.yaml

14 directories, 13 files

+++ Testing ./example/helm_vars/projectX/production/us-east-1/java-app/secrets.yaml
+++ Encrypt and Test
[OK] File properly encrypted
+++ Test if 'Already Encrypted' feature works
[OK] Already Encrypted
+++ View encrypted Test
[OK] File decrypted and viewable
+++ Decrypt
[OK] File decrypted
+++ Cleanup Test
[OK] Cleanup specified directory
[OK] Cleanup specified .dec file
+++ Once again Encrypt and Test
[OK] File properly encrypted
+++ Testing ./example/helm_vars/projectX/sandbox/us-east-1/java-app/secrets.yaml
+++ Encrypt and Test
[OK] File properly encrypted
+++ Test if 'Already Encrypted' feature works
[OK] Already Encrypted
+++ View encrypted Test
[OK] File decrypted and viewable
+++ Decrypt
[OK] File decrypted
+++ Cleanup Test
[OK] Cleanup specified directory
[OK] Cleanup specified .dec file
+++ Once again Encrypt and Test
[OK] File properly encrypted
+++ Testing ./example/helm_vars/projectY/production/us-east-1/java-app/secrets.yaml
+++ Encrypt and Test
[OK] File properly encrypted
+++ Test if 'Already Encrypted' feature works
[OK] Already Encrypted
+++ View encrypted Test
[OK] File decrypted and viewable
+++ Decrypt
[OK] File decrypted
+++ Cleanup Test
[OK] Cleanup specified directory
[OK] Cleanup specified .dec file
+++ Once again Encrypt and Test
[OK] File properly encrypted
+++ Testing ./example/helm_vars/projectY/sandbox/us-east-1/java-app/secrets.yaml
+++ Encrypt and Test
[OK] File properly encrypted
+++ Test if 'Already Encrypted' feature works
[OK] Already Encrypted
+++ View encrypted Test
[OK] File decrypted and viewable
+++ Decrypt
[OK] File decrypted
+++ Cleanup Test
[OK] Cleanup specified directory
[OK] Cleanup specified .dec file
+++ Once again Encrypt and Test
[OK] File properly encrypted
+++ Testing ./example/helm_vars/secrets.yaml
+++ Encrypt and Test
[OK] File properly encrypted
+++ Test if 'Already Encrypted' feature works
[OK] Already Encrypted
+++ View encrypted Test
[OK] File decrypted and viewable
+++ Decrypt
[OK] File decrypted
+++ Cleanup Test
[OK] Cleanup specified directory
[OK] Cleanup specified .dec file
+++ Once again Encrypt and Test
[OK] File properly encrypted