Gossip encryption key secret name mismatched when set autoGenerate=true with a custom chart name

[mntforever]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.

---

Overview of the Issue

When i run the helm install hashicorp/consul with a name dc1 and the global.gossipEncryption.autoGenerate set to true. The job dc1-consul-create-federation-secret can't be completed. Because this job needs a secret with the name consul-gossip-encryption-key, but the secret with the name dc1-consul-gossip-encryption-key was created instead.

In the helm chart template, we can see that:

• consul-k8s/charts/consul/templates/gossip-encryption-autogenerate-job.yaml

...
      containers:
        - name: gossip-encryption-autogen
          image: "{{ .Values.global.imageK8S }}"
          command:
            - "/bin/sh"
            - "-ec"
            - |
              consul-k8s-control-plane gossip-encryption-autogenerate \
                -namespace={{ .Release.Namespace }} \
                -secret-name={{ template "consul.fullname" . }}-gossip-encryption-key \
                -secret-key="key" \
                -log-level={{ .Values.global.logLevel }} \
                -log-json={{ .Values.global.logJSON }}
          resources:
            requests:
              memory: "50Mi"
              cpu: "50m"
            limits:
              memory: "50Mi"
              cpu: "50m"
...

• consul-k8s/charts/consul/templates/create-federation-secret-job.yaml

...
{{- else if .Values.global.gossipEncryption.autoGenerate }}
- name: gossip-encryption-key
    secret:
    secretName: consul-gossip-encryption-key
    items:
        - key: key
        path: gossip.key
{{- end }}
...

Reproduction Steps

1. Create values.yaml with the following values:

global:
  enabled: true
  domain: consul
  image: "consul:1.11.5"
  imageK8S: hashicorp/consul-k8s-control-plane:0.41.1
  imageEnvoy: envoyproxy/envoy-alpine:v1.20.2
  datacenter: dc1
  federation:
    enabled: true
    createFederationSecret: true
    primaryDatacenter: dc1
  gossipEncryption:
    autoGenerate: true
  tls:
    enabled: true
    verify: true
    enableAutoEncrypt: true
    httpsOnly: false
  acls:
    manageSystemACLs: true
    createReplicationToken: true
server:
  replicas: 1
  bootstrapExpect: 1
connectInject:
  enabled: true
controller:
  enabled: true

2. Run the command:

helm install dc1 -f values.yaml hashicorp/consul --version "0.41.1" -n consul

3. View the secrets:

NAME                                                           TYPE                                  DATA   AGE
...
dc1-consul-gossip-encryption-key                               Opaque                                1      32m
...

4. View the error:

dc1-consul-create-federation-secret-t4r4s          0/1     Init:0/1    0          12m   <none>

Logs

Warning  FailedMount  113s                kubelet            Unable to attach or mount volumes: unmounted volumes=[gossip-encryption-key], unattached volumes=[kube-api-access-g6nz6 consul-ca-key gossip-encryption-key consul-ca-cert consul-auto-encrypt-ca-cert]: timed out waiting for the condition
Warning  FailedMount  42s (x14 over 13m)  kubelet            MountVolume.SetUp failed for volume "gossip-encryption-key" : secret "consul-gossip-encryption-key" not found

Expected behavior

The consul create federation secret job can be done.

Environment details

consul-k8s: v0.41.1

consul: v1.11.5

[t-eckert]

Hi @mntforever,

Thank you for bringing this to our attention. I was able to recreate the issue with your description and have opened a pull request with the fix. This issue will be fixed in the 0.44.0 release of Consul on Kubernetes. For now, you can bypass the issue by installing Consul on Kubernetes with the dc1 release name omitted so long as that is acceptable to you.

The command would be

helm install -f values.yaml hashicorp/consul --version "0.41.1" -n consul

[david-yu]

Fixed by #1196