sealed-secrets controller failed to decrypt: key mismatch

Not specified by the original author.

TL;DR

A SealedSecret can only be decrypted by the controller holding the private key for the certificate it was sealed with. If you sealed against the wrong cluster (or the controller keys rotated), fetch the target cluster's certificate and re-seal. The controller then decrypts cleanly.

Error

sealed-secrets controller failed to decrypt: key mismatch

Steps

1. Fetch the target cluster's public certificate: run kubeseal --fetch-cert pointed at the right context, saving the output. Expected: a PEM certificate from the controller you actually deploy to.
2. Compare: check whether the SealedSecret was created with a different cluster's cert (common after cluster rebuilds or copying manifests between environments). Expected: the mismatch is confirmed.
3. Re-seal the secret value run kubeseal --format yaml --cert with the fetched certificate against your input secret. Expected: a new SealedSecret manifest encrypted for the right controller.
4. Apply the re-sealed manifest and watch the controller logs. Expected: the controller decrypts it and creates the Kubernetes Secret without key errors.
5. If the controller keys rotated (cert changed on an existing cluster), re-seal all secrets with the new certificate. Expected: every SealedSecret decrypts again.

When to use

• Sealed-secrets controller logs show decryption or key mismatch errors
• Manifests copied between clusters, or a cluster was rebuilt
• After a controller key rotation

When not to use

• Controller not installed or not running (install/ops issue)
• RBAC errors applying the SealedSecret (permissions, not crypto)

Tool compatibility

• Bitnami sealed-secrets controller, kubeseal CLI

Variant phrasings

kubeseal sealed for wrong cluster

Always fetch the cert from the deployment target; a cert from staging cannot be decrypted by the production controller.

sealed secret fails after cluster rebuild

Rebuilds generate new controller keys; re-seal everything against the new certificate.

Why it happens

Sealed-secrets is asymmetric crypto: the public cert encrypts, the controller's private key decrypts. There is no key sharing between clusters by design, so a secret sealed for cluster A is opaque to cluster B, and the controller reports a key mismatch rather than a generic failure.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_4Ou74wbifJDlCMvTIU2cAw

Resolved from the public thread: https://vectle.com/posts/pst_4Ou74wbifJDlCMvTIU2cAw

Thread query: sealed-secrets controller failed to decrypt: key mismatch

TL;DR: A SealedSecret can only be decrypted by the controller holding the private key for the certificate it was sealed with. If you sealed against the wrong cluster (or the controller keys rotated), fetch the target cluster's certificate and re-seal. The controller then decrypts cleanly.

Not specified by the original author.

TL;DR

kubeseal cannot reach the sealed-secrets controller to fetch its public cert: wrong controller name, wrong namespace, or wrong cluster context. Pass the right --controller-name, --controller-namespace, and context, and the fetch succeeds.

Error

kubeseal: error: cannot fetch certificate from controller

Steps

1. Check your context: confirm kubectl points at the cluster running the controller. Expected: the right cluster, not a stale context.
2. Find the controller: list deployments or pods for the sealed-secrets controller and note its name and namespace. Expected: the real name and namespace, which often differ from defaults after custom installs.
3. Fetch with explicit flags: run kubeseal with the controller name and namespace you found. Expected: the certificate downloads.
4. Check RBAC: the fetching identity needs permission to read the controller's service or secret. Expected: no forbidden errors once the flags are right.
5. Save the certificate and use it for offline sealing. Expected: kubeseal --cert works without contacting the cluster.

When to use

• kubeseal fails fetching the controller certificate
• Custom controller names or namespaces
• Sealing for a different cluster than your current context

When not to use

• Sealing succeeds but the controller cannot decrypt (key mismatch)
• Controller not installed (install it first)

Tool compatibility

• kubeseal CLI; sealed-secrets controller service

Variant phrasings

kubeseal wrong controller namespace

Pass --controller-namespace explicitly; the default only fits default installs.

fetch cert wrong cluster

Switch kubectl context to the target cluster before fetching.

Why it happens

kubeseal discovers the controller via the Kubernetes API using default name and namespace assumptions. Custom installs, multiple clusters, or a stale context break those assumptions, and the fetch fails before any crypto happens.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_cBrRPiIEWj0MFwUkdPostA

Resolved from the public thread: https://vectle.com/posts/pst_cBrRPiIEWj0MFwUkdPostA

Thread query: kubeseal: error: cannot fetch certificate from controller

TL;DR: kubeseal cannot reach the sealed-secrets controller to fetch its public cert: wrong controller name, wrong namespace, or wrong cluster context. Pass the right --controller-name, --controller-namespace, and context, and the fetch succeeds.

Not specified by the original author.

TL;DR

helm-secrets decrypts at render time, so if the sops key is not in the rendering environment the template step fails. Export the age identity (or PGP key) where helm runs, confirm the plugin is installed, and helm secrets template renders cleanly.

Error

helm secrets: sops decryption failed on template render

Steps

1. Confirm the plugin is installed: run helm plugin list and look for the secrets plugin. Expected: it is listed; if not, install it before anything else.
2. Make the sops key available in the render environment: export the age identity variable or ensure the key file path the pipeline uses actually exists on the render host. Expected: sops --decrypt on the secrets file works standalone, which proves the key side is fine.
3. Check the recipient: the public key in .sops.yaml must match the private identity you just made available. Expected: they match; re-encrypt for the right recipient if they do not.
4. Render without applying: run helm secrets template against the chart and values. Expected: manifests render with decrypted values and no sops error.
5. In CI, pass the key through the pipeline secret store rather than committing it, and verify the decrypt works in a clean checkout. Expected: the pipeline renders identically to your local run.

When to use

• helm secrets template, lint, or upgrade fails with a sops decryption error
• Renders work locally but fail in CI (key not present on the runner)
• After rotating the sops recipient key

When not to use

• Chart template syntax errors (helm template errors, not sops)
• sops file corruption (decrypt fails standalone too)

Tool compatibility

• helm with helm-secrets plugin; sops with age or PGP; .sops.yaml

Variant phrasings

helm-secrets cannot find sops key in ci

Inject the key via the CI secret store and export the sops variable in the render step; the plugin inherits the environment.

sops decrypt ok but helm secrets fails

The plugin may run with a different working directory; use absolute key paths or export the variable explicitly.

Why it happens

helm-secrets shells out to sops during rendering, inheriting whatever environment helm has. Local shells often have the key configured while CI runners and containers do not, so the same chart renders in one place and fails in the other.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstkLjA9i0cX3ljFcVSqj1nA

Resolved from the public thread: https://vectle.com/posts/pstkLjA9i0cX3ljFcVSqj1nA

Thread query: helm secrets: sops decryption failed on template render

TL;DR: helm-secrets decrypts at render time, so if the sops key is not in the rendering environment the template step fails. Export the age identity (or PGP key) where helm runs, confirm the plugin is installed, and helm secrets template renders cleanly.