<p>In my case, my Amazon EKS is provisioned by <a href="https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest" rel="nofollow noreferrer">terraform-aws-modules</a>,</p>
<p><code>kubeseal</code> is using port 8080.</p>
<p>After updating my node security policy to allow connection from port 8080, <code>kubeseal</code> can work properly.</p>
<pre><code>module &quot;eks&quot; {
  source = &quot;terraform-aws-modules/eks/aws&quot;
  # ...
  node_security_group_additional_rules = {
    # For kubeseal
    ingress_8080 = {
      type                          = &quot;ingress&quot;
      protocol                      = &quot;tcp&quot;
      from_port                     = 8080
      to_port                       = 8080
      source_cluster_security_group = true
    }
  }
}
</code></pre>
<p>Reference: <a href="https://github.com/bitnami-labs/sealed-secrets/issues/699#issuecomment-1053971055" rel="nofollow noreferrer">https://github.com/bitnami-labs/sealed-secrets/issues/699#issuecomment-1053971055</a></p>

CC BY-SA 4.0
2024-06-17T10:50:28.250Z
2024-06-17T10:50:28.250Z
Hongbo Miao
<p>I am using Amazon EKS.</p>
<p>I can list my services by</p>
<pre class="lang-sh prettyprint-override"><code>kubectl get services -n production-sealed-secrets
NAME                     TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
sealed-secrets           ClusterIP   10.100.154.89   &lt;none&gt;        8080/TCP   4d8h
sealed-secrets-metrics   ClusterIP   10.100.194.36   &lt;none&gt;        8081/TCP   4d8h
</code></pre>
<p>However, when I try to use Sealed Secrets to seal my secret by:</p>
<p><strong>my-secret.unsealed.yaml</strong>:</p>
<pre class="lang-yaml prettyprint-override"><code>---
apiVersion: v1
kind: Secret
metadata:
  name: production-airbyte-secret
  namespace: production-airbyte
stringData:
  AWS_ACCESS_KEY_ID: xxx
  AWS_SECRET_ACCESS_KEY: xxx
</code></pre>
<pre class="lang-sh prettyprint-override"><code>cat my-secret.unsealed.yaml | \
kubeseal \
  --controller-namespace=production-sealed-secrets \
  --controller-name=sealed-secrets \
  --format=yaml \
  &gt; my-secret.yaml
</code></pre>
<p>I got error</p>
<blockquote>
<p>error: cannot fetch certificate: error trying to reach service: dial tcp 172.31.13.104:8080: connect: connection timed out</p>
</blockquote>
<p>Any ideas how to solve this error?</p>

<kubernetes><amazon-web-services><eks>
Sealed Secrets got "error: cannot fetch certificate" in Amazon EKS cluster
Hongbo Miao
# Sealed Secrets got "error: cannot fetch certificate" in Amazon EKS cluster

(Asked by: username_0 on 2024-06-17)

I am using Amazon EKS.
I can list my services by
kubectl get services -n production-sealed-secrets
NAME                     TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
sealed-secrets           ClusterIP   10.100.154.89           8080/TCP   4d8h
sealed-secrets-metrics   ClusterIP   10.100.194.36           8081/TCP   4d8h

However, when I try to use Sealed Secrets to seal my secret by:
my-secret.unsealed.yaml:
---
apiVersion: v1
kind: Secret
metadata:
  name: production-airbyte-secret
  namespace: production-airbyte
stringData:
  AWS_ACCESS_KEY_ID: xxx
  AWS_SECRET_ACCESS_KEY: xxx

cat my-secret.unsealed.yaml | \
kubeseal \
  --controller-namespace=production-sealed-secrets \
  --controller-name=sealed-secrets \
  --format=yaml \
  > my-secret.yaml

I got error

error: cannot fetch certificate: error trying to reach service: dial tcp 172.31.13.104:8080: connect: connection timed out

Any ideas how to solve this error?

**Tags:** kubernetes, amazon-web-services, eks


---

## 1 answers

### Answer by username_0 on 2024-06-17. Score: 0 | Accepted answer

In my case, my Amazon EKS is provisioned by terraform-aws-modules,
kubeseal is using port 8080.
After updating my node security policy to allow connection from port 8080, kubeseal can work properly.
module "eks" {
  source = "terraform-aws-modules/eks/aws"
  # ...
  node_security_group_additional_rules = {
    # For kubeseal
    ingress_8080 = {
      type                          = "ingress"
      protocol                      = "tcp"
      from_port                     = 8080
      to_port                       = 8080
      source_cluster_security_group = true
    }
  }
}

Reference: https://github.com/bitnami-labs/sealed-secrets/issues/699#issuecomment-1053971055


---

