SOPS won't work

[davidkarlsen]

I can't import the key, getting:

{"level":"error","ts":"2021-02-20T17:59:00.518Z","logger":"controller.kustomization","msg":"Reconciliation failed after 797.005257ms, next try in 10m0s","reconciler group":"kustomize.toolkit.fluxcd.io","reconciler kind":"Kustomization","name":"flux-system","namespace":"flux-system","revision":"os-sandbox/3c6ae92552d3550b4f179395bc1eca280f9fb841","error":"gpg import error: gpg: out of core handler ignored in FIPS mode\ngpg: keybox '/tmp/decryptor-flux-system-181986973/pubring.kbx' created\ngpg: /tmp/decryptor-flux-system-181986973/trustdb.gpg: trustdb created\ngpg: key C649D93AF85FB644: public key \"kube-backup-icp-global (kube-backup key) <[email protected]>\" imported\ngpg: key C649D93AF85FB644: secret key imported\ngpg: WARNING: key C649D93AF85FB644 contains preferences for unavailable\nalgorithms on these user IDs:\ngpg:          \"kube-backup-icp-global (kube-backup key) <[email protected]>\": preference for cipher algorithm 3\ngpg: it is strongly suggested that you update your preferences and\ngpg: re-distribute this key to avoid potential algorithm mismatch problems\ngpg: cannot open '/dev/tty': No such device or address\n"}

Also note that this is a FIPS enabled node - don't know if that is actually causing the error of if it is just a warning.

Maybe this is related to https://github.com/fluxcd/kustomize-controller and not source-controller?

Running v0.8.1.

[davidkarlsen]

Found the issue, if you add tty: true to the kustomize-controller, it will print:

Set preference list to:
     Cipher: AES256, AES192, AES, 3DES
     AEAD: 
     Digest: SHA512, SHA384, SHA256, SHA224, SHA1
     Compression: ZLIB, BZIP2, ZIP, Uncompressed
     Features: MDC, AEAD, Keyserver no-modify

and hang there,
so I exec'ed into the container and ran the same import command.

and then get promted:

Really update the preferences? (y/N) y
                                      
gpg: Total number processed: 1
gpg:              unchanged: 1
gpg:       secret keys read: 1
gpg:  secret keys unchanged: 1

which makes the import succeed.

[davidkarlsen]

It seems to pass just fine if you add --batch to the args for gpg

[stefanprodan]

Fixed by #281

[davidkarlsen]

awesome - can you push a release so we can drop the custom patched image and do vanilla bootstrap?