another key secret is getting created after restoring from backup
Author: jenneronCreated Aug 27, 2024Updated Apr 17, 2026
Labelstriage
Which component: controller
Describe the bug After restoring from backup there are 2 secrets instead of 1, and it gets re-created after removing it
To Reproduce
- Get a secret backup:
kubectl get secret -n kube-system -l sealedsecrets.bitnami.com/sealed-secrets-key -o yaml >main.key- Provision a new cluster and restore secret:
kubectl apply -f main.key
kubectl delete pod -n kube-system -l app.kubernetes.io/name=sealed-secretsRemove old secret created before restoring backup
Restart pod
See another secret getting created
jenneron@pc:~$ k get secret -n kube-system | grep sealed
sealed-secrets-keyqzkq8 kubernetes.io/tls 2 3d18h
sealed-secrets-keywhg68 kubernetes.io/tls 2 39d
sh.helm.release.v1.sealed-secrets.v1 helm.sh/release.v1 1 39dYou can delete it, but it gets re-created after restarting pod
Expected behavior
Possibility to properly back up and restore key used for encrypting secrets without introducing more keys as it makes further backups more complicated
Version of Kubernetes:
- Output of
kubectl version:
Client Version: v1.29.7
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.29.6+k3s2Additional context
The main problem with this is that each backup/restore cycle requires +1 key to backup, and it is not possible to use older backup after restoring second time
Source: bitnami/sealed-secrets