search

SAP-archive / karydia

Kubernetes Security Walnut
Other
77 stars 10 forks source link

scripts/create-karydia-tls-secret: error: unable to decode "STDIN" #76

Closed thkukuk closed 5 years ago

thkukuk commented 5 years ago

I tried to use karydia on openSUSE Kubic, but failed with the scripts/create-karydia-tls-secret script (kubectl 1.13.4).

The error I get is: error: error validating "STDIN": error validating data: [apiVersion not set, kind not set]; if you choose to ignore these errors, turn validation off with --validate=false

If you disable validation, it will of course fail with kind not set.

dacappo commented 5 years ago

Hi @thkukuk, it seems that the kubectl apply at the end of the script is failing. Can you provide the intermediate result of the kubectl create secret generic which is piped into the kubectl apply (just comment out the | and the last line). Are the server and client version given by kubectl both 1.13.4?

Best, Patrick

thkukuk commented 5 years ago

Server and client are both 1.13.4.

The output is:

data: cert.pem: LS0... key.pem: LS0... metadata: creationTimestamp: null name: karydia-tls

ionysos commented 5 years ago

Hi @thkukuk, thanks for opening an issue for that.

We (our team), only focused at plain Kubernetes and Gardener Kubernetes clusters till now. Thus, we don't know the openSUSE Kubic project in detail.

A first quick look lets me tend to some idiosyncrasies of openSUSE Kubic but this is just an uneducated guess.

Do you have some more knowledge with openSUSE Kubic and maybe already know what the problem could be? If yes, we would be more than happy if you could provide a pull request to fix this. If no, it would be great if you could provide us as much information regarding this issue as possible (e.g. openSUSE Kubic version, cloud provider or hardware configuration, OS (e.g. cat /etc/os-release), Kernel (e.g. uname -a), ...).

Best regards, Jonas

thkukuk commented 5 years ago

Ok, found the problem: kubectl 1.13.x does not create a correct yaml file which it could apply afterwards, kubectl 1.14.0 does this. So this is now working, maybe a hint that at minimum kubectl 1.14.0 is required would be helpful.

ionysos commented 5 years ago

Thanks for further investigating this issue! It's great to hear that it's now working for you!!