secret was encrypted with newer version error about kubesec HOT 6 CLOSED

Hi.
Check that

1. secret-oxidixed-id-rsa.pub.yml is actually encrypted (it should contain # kubesec:v:4)
2. kubesec --version where you are trying to kubesec decrypt is >= kubesec --version when secret was encrypted.

from kubesec.

Hi,

Thanks for the quick reply, I figured out the issue; it happens when I add the encrypted file to my gitlab repository:

1. Create a new secret.yml file.
2. kubesec encrypt
   --key=aws:arn:aws:kms:us-west-1:000000000000:key/00000000-0000-0000-0000-000000000000 secret.yml
3. commit and push secret.yml to gitlab repository
4. git clone gitlab repository in a new folder
5. kubesec decrypt gives the error.

Something happens with the file, the MD5 hash of the locally created file and git cloned file are different. Not sure what git(lab) does and if this also happens with github.

md5sum secret.yml
fe456c002f07b37edd5234ec7d10ad45 *secret.yml

md5sum secret.yml
cfc92c6bb9ccd7ee21ce2916132ff7d0 *secret.yml

from kubesec.

Here is an example btw:

apiVersion: v1
data:
  id_rsa.pub: c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEMTZ1Ri9LYklSQUVKVVRkSmNyQzduK2ZmazBmWGVrSzhBbnpqU0FTczUxL2hmOTA1VmcrOWZ0b0Z3MmJzQkRKWW1qalJXVVVkSGlQSFNnUFd0WkVPK00xa1g5WVNzNVdaVW03VVFsdklWNnhoVFVVMXlFUHpBVkw0aDYvSnpnSkFack53WUdnSUNxdDJoYktwUGJ1T3BiUmQ0ZmVNSUFZc2JnVjhWRzVrN2RTTWk2UnIyN3lqRlptSWs0cnlXNWw1c2tHTFNnWFh4VFdkOVp3T3RjYVVYeS9NRkZIbGtLZytjU043cGZXRFhuaEU2cGFYb0hQM0lnemlpT1FuMnNXWUlTdGxJcUplUDNLRDdyWVZBanI5a0lFbkNNS1hETzR5Z2E1S3VGdjRIeU96U0FWSzRSZmtwRXJ4U1E5eHowYmJCczJDdER0YWRmNUs0bk5tcjNyZEogamFtZXNAamFtZXM=
kind: Secret
metadata:
  name: secret-oxidized-id-rsa-pub
type: Opaque

When you kubesec encrypt this, commit it to a repo, then pull it to another folder then you can't decrypt it anymore. Perhaps this is a git issue with very long lines?

from kubesec.

Any chance you have .gitattributes with newline normalization? https://help.github.com/en/articles/dealing-with-line-endings

from kubesec.

I don't have one, I did use kubesec on Windows. Should I try it?

from kubesec.

I've encounted same issue, and it was caused via EOL.
git commited secrets.enc.yaml was LF, but cloned was CRLF.

I can avoid issue with change file eol to LF and use .gitattributes to specify file EOL.

from kubesec.