Answers: <p>In my case, my Amazon EKS is provisioned by <a href="https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest" rel="nofollow noreferrer">terraform-aws-modules</a>,</p>
  <p><code>kubeseal</code> is using port 8080.</p>
  <p>After updating my node security policy to allow connection from port 8080, <code>kubeseal</code> can work properly.</p>
  <pre><code>module &quot;eks&quot; {
    source = &quot;terraform-aws-modules/eks/aws&quot;
    # ...
    node_security_group_additional_rules = {
      # For kubeseal
      ingress_8080 = {
        type                          = &quot;ingress&quot;
        protocol                      = &quot;tcp&quot;
        from_port                     = 8080
        to_port                       = 8080
        source_cluster_security_group = true
      }
    }
  }
  </code></pre>
  <p>Reference: <a href="https://github.com/bitnami-labs/sealed-secrets/issues/699#issuecomment-1053971055" rel="nofollow noreferrer">https://github.com/bitnami-labs/sealed-secrets/issues/699#issuecomment-1053971055</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2024-06-17T10:50:28.250Z
Answers: 2024-06-17T10:50:28.250Z
Answers: Hongbo Miao
Body: <p>I am using Amazon EKS.</p>
  <p>I can list my services by</p>
  <pre class="lang-sh prettyprint-override"><code>kubectl get services -n production-sealed-secrets
  NAME                     TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
  sealed-secrets           ClusterIP   10.100.154.89   &lt;none&gt;        8080/TCP   4d8h
  sealed-secrets-metrics   ClusterIP   10.100.194.36   &lt;none&gt;        8081/TCP   4d8h
  </code></pre>
  <p>However, when I try to use Sealed Secrets to seal my secret by:</p>
  <p><strong>my-secret.unsealed.yaml</strong>:</p>
  <pre class="lang-yaml prettyprint-override"><code>---
  apiVersion: v1
  kind: Secret
  metadata:
    name: production-airbyte-secret
    namespace: production-airbyte
  stringData:
    AWS_ACCESS_KEY_ID: xxx
    AWS_SECRET_ACCESS_KEY: xxx
  </code></pre>
  <pre class="lang-sh prettyprint-override"><code>cat my-secret.unsealed.yaml | \
  kubeseal \
    --controller-namespace=production-sealed-secrets \
    --controller-name=sealed-secrets \
    --format=yaml \
    &gt; my-secret.yaml
  </code></pre>
  <p>I got error</p>
  <blockquote>
  <p>error: cannot fetch certificate: error trying to reach service: dial tcp 172.31.13.104:8080: connect: connection timed out</p>
  </blockquote>
  <p>Any ideas how to solve this error?</p>
  
Tags: <kubernetes><amazon-web-services><eks>
Title: Sealed Secrets got "error: cannot fetch certificate" in Amazon EKS cluster
UserDisplayName: Hongbo Miao
ThreadText: # Sealed Secrets got "error: cannot fetch certificate" in Amazon EKS cluster
  
  (Asked by: username_0 on 2024-06-17)
  
  I am using Amazon EKS.
  
  I can list my services by
  
  ```sh
  kubectl get services -n production-sealed-secrets
  NAME                     TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
  sealed-secrets           ClusterIP   10.100.154.89   <none>        8080/TCP   4d8h
  sealed-secrets-metrics   ClusterIP   10.100.194.36   <none>        8081/TCP   4d8h
  
  ```
  
  However, when I try to use Sealed Secrets to seal my secret by:
  
  **my-secret.unsealed.yaml**:
  
  ```yaml
  ---
  apiVersion: v1
  kind: Secret
  metadata:
    name: production-airbyte-secret
    namespace: production-airbyte
  stringData:
    AWS_ACCESS_KEY_ID: xxx
    AWS_SECRET_ACCESS_KEY: xxx
  
  ```
  
  ```sh
  cat my-secret.unsealed.yaml | \
  kubeseal \
    --controller-namespace=production-sealed-secrets \
    --controller-name=sealed-secrets \
    --format=yaml \
    > my-secret.yaml
  
  ```
  
  I got error
  
  > error: cannot fetch certificate: error trying to reach service: dial tcp 172.31.13.104:8080: connect: connection timed out
  
  Any ideas how to solve this error?
  
  **Tags:** kubernetes, amazon-web-services, eks
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2024-06-17. Score: 0 | Accepted answer
  
  In my case, my Amazon EKS is provisioned by [terraform-aws-modules](https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest),
  
  `kubeseal` is using port 8080.
  
  After updating my node security policy to allow connection from port 8080, `kubeseal` can work properly.
  
  ```
  module "eks" {
    source = "terraform-aws-modules/eks/aws"
    # ...
    node_security_group_additional_rules = {
      # For kubeseal
      ingress_8080 = {
        type                          = "ingress"
        protocol                      = "tcp"
        from_port                     = 8080
        to_port                       = 8080
        source_cluster_security_group = true
      }
    }
  }
  
  ```
  
  Reference: <https://github.com/bitnami-labs/sealed-secrets/issues/699#issuecomment-1053971055>
  
  
  ---
  
  