Sealed Secrets got "error: cannot fetch certificate" in Amazon EKS cluster

Question

I am using Amazon EKS.

I can list my services by

kubectl get services -n production-sealed-secrets
NAME                     TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
sealed-secrets           ClusterIP   10.100.154.89   <none>        8080/TCP   4d8h
sealed-secrets-metrics   ClusterIP   10.100.194.36   <none>        8081/TCP   4d8h

However, when I try to use Sealed Secrets to seal my secret by:

my-secret.unsealed.yaml:

---
apiVersion: v1
kind: Secret
metadata:
  name: production-airbyte-secret
  namespace: production-airbyte
stringData:
  AWS_ACCESS_KEY_ID: xxx
  AWS_SECRET_ACCESS_KEY: xxx

cat my-secret.unsealed.yaml | \
kubeseal \
  --controller-namespace=production-sealed-secrets \
  --controller-name=sealed-secrets \
  --format=yaml \
  > my-secret.yaml

I got error

error: cannot fetch certificate: error trying to reach service: dial tcp 172.31.13.104:8080: connect: connection timed out

Any ideas how to solve this error?

Answer 1

In my case, my Amazon EKS is provisioned by terraform-aws-modules,

kubeseal is using port 8080.

After updating my node security policy to allow connection from port 8080, kubeseal can work properly.

module "eks" {
  source = "terraform-aws-modules/eks/aws"
  # ...
  node_security_group_additional_rules = {
    # For kubeseal
    ingress_8080 = {
      type                          = "ingress"
      protocol                      = "tcp"
      from_port                     = 8080
      to_port                       = 8080
      source_cluster_security_group = true
    }
  }
}

Reference: https://github.com/bitnami-labs/sealed-secrets/issues/699#issuecomment-1053971055