KSOPS error on decrypting when integrate with ArgoCD

[PhamQuang-512]

i have follow the docs and create a test application to mange secret but i'm getting this error
failed to evaluate function: error decrypting file "test.yaml" from manifest.Files: trouble decrypting file: Error getting data key: 0 successful groups required, got 0unable to generate manifests: error decrypting file "test.yaml" from manifest.Files: trouble decrypting file: Error getting data key: 0 successful groups required, got 0Error: couldn't execute function: exit status 1
i have tried to exec into repo-server and clone my repo and decrypt using kustomize build --enable-alpha-plugins --enable-exec and it still ok
i'm using helm chart argo/argo-cd version 7.4.3 - argocd version v2.12.0

[dosubot]

Hey @PhamQuang-512! 👋 I'm here to help you with your KSOPS error. I'm a bot designed to assist with bug fixes, answer questions, and help you become a contributor. Let's tackle this together!

To resolve the KSOPS decryption error when integrating with ArgoCD, ensure that ArgoCD is configured to enable kustomize plugins. You need to add the --enable-alpha-plugins flag to the kustomize.buildOptions setting in the ArgoCD ConfigMap:

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
data:
  kustomize.buildOptions: "--enable-alpha-plugins"

Additionally, make sure the KSOPS executable is in your PATH or that the path to the executable in the generator manifest is correctly specified relative to the manifest files. Also, ensure that the XDG_CONFIG_HOME environment variable is set in your shell, as KSOPS relies on this configuration ^[1][2].

To continue talking to Dosu, mention @dosu.

[PhamQuang-512]

i have added that option from the beginning

[tolundel]

I have a same problem in here:

Argo gives:
Failed to load target state: failed to generate manifest for source 1 of 1: rpc error: code = Unknown desc = Manifest generation error (cached): kustomize build /deployment/prod --enable-alpha-plugins --enable-exec failed exit status 1: failed to evaluate function: error decrypting file "./encrypted_secret.sops.yaml" from manifest.Files: trouble decrypting file: Error getting data key: 0 successful groups required, got 0unable to generate manifests: error decrypting file "./encrypted_secret.sops.yaml" from manifest.Files: trouble decrypting file: Error getting data key: 0 successful groups required, got 0Error: couldn't execute function: exit status 1

And same directly from bash:
ksops secret-generator.yaml unable to generate manifests: error decrypting file "./encrypted_secret.sops.yaml" from manifest.Files: trouble decrypting file: Error getting data key: 0 successful groups required, got 0

Argo have worked fine months before but now after reboot this appears.

[tolundel]

I have looked it a hours before i wrote previous one and 30sec later i changed

- name: XDG_CONFIG_HOME value: /usr/local/bin
to
- name: XDG_CONFIG_HOME value: /.config

And it's solved a problem.

[PietervdWerk]

I still have the same issue

XDG_CONFIG_HOME is /.config and I exec-ed in the pod and verified that my key is there and the key works (which is validated with kustomize build --enable-alpha-plugins --enable-exec).

What could still be the problem? I've chart version 7.8.2 and kustomize version and viaductoss/ksops:v4.3.3

[max-allan-cgr]

Ksops cannot find the GPG keys. (Assuming you're using GPG, there is probably some similar solution for AGE).
If you're using a recent version of the helm chart, you can add an extra env variable so that ksops picks up the correct path:

repoServer:
  env: 
    - name: GNUPGHOME
      value: /app/config/gpg/keys/

Obviously if you're configuring things to move the GPG home mount, you'll need to make that value match whatever you're doing.

If you exec into the argocd-repo-server pod and can do gpg -k and it lists the key you used for encrypting, then it should start working. If gpg doesn't show the key, then you may need to import it again. The default deployment uses an emptyDir, so if you helm upgrade - the directory will be wiped and your key will disappear.