Disabling encryptionProviders doesn't decrypt Secrets automatically

[xmudrii]

Discussed in https://github.com/kubermatic/kubeone/discussions/3095

^{Originally posted by **clickersmudge** March 25, 2024} Hi, I would like to report an error. When I run a new installation of KubeOne with the configuration. kubeone.yaml ``` apiVersion: kubeone.k8c.io/v1beta2 kind: KubeOneCluster versions: kubernetes: "v1.27.11" clusterNetwork: cni: canal: mtu: 1400 cloudProvider: hetzner: {} external: true features: encryptionProviders: enable: true ``` Everything works. However, when I change ``` features: encryptionProviders: enable: false ``` and run ``` kubeone apply --credentials credentials.yaml --manifest kubeone.yaml --tfjson tf.json --force-upgrade ``` I have an error ``` WARN[15:17:26 CET] Retrying task... INFO[15:17:26 CET] Creating machine-controller credentials secret... WARN[15:17:26 CET] Task failed, error was: kubernetes: getting *v1.Secret kube-system/kubeone-machine-controller-credentials Internal error occurred: identity transformer tried to read encrypted data WARN[15:18:42 CET] Retrying task... INFO[15:18:42 CET] Creating machine-controller credentials secret... WARN[15:18:42 CET] Task failed, error was: kubernetes: getting *v1.Secret kube-system/kubeone-machine-controller-credentials Internal error occurred: identity transformer tried to read encrypted data WARN[15:20:27 CET] Retrying task... INFO[15:20:28 CET] Creating machine-controller credentials secret... WARN[15:20:28 CET] Task failed, error was: kubernetes: getting *v1.Secret kube-system/kubeone-machine-controller-credentials Internal error occurred: identity transformer tried to read encrypted data WARN[15:22:56 CET] Retrying task... INFO[15:22:56 CET] Creating machine-controller credentials secret... WARN[15:22:56 CET] Task failed, error was: kubernetes: getting *v1.Secret kube-system/kubeone-machine-controller-credentials Internal error occurred: identity transformer tried to read encrypted data ``` 

[xmudrii]

I see two options:

• Automatically decrypt Secrets upon disabling encryptionProviders
• if not possible, warn users to manually decrypt Secrets and provide instructions for that

[xmudrii]

Also relevant to https://github.com/kubermatic/kubeone/discussions/3096

[clickersmudge]

Probably also revelant to #3098