Bootstrap: ExternalSecrets reference ClusterSecretStore/kubara-demo-sandbox which is never created, causing SecretSyncedError on fresh installs

[monadic]

Summary

Kubara deploys ExternalSecret resources in every app namespace (both image-pull-secret-es and grafana-admin-credentials-es) that reference ClusterSecretStore/kubara-demo-sandbox, but this ClusterSecretStore is never created as part of the bootstrap process. All ExternalSecrets fail immediately on a fresh install.

Affected namespaces

image-pull-secret-es is deployed in: argocd, cert-manager, external-secrets, homer-dashboard, kube-prometheus-stack, kyverno, kyverno-policy-reporter, metallb, metrics-server, traefik.

grafana-admin-credentials-es is deployed in: kube-prometheus-stack.

Observed

error processing spec.data[0] (key: docker_config):
could not get ClusterSecretStore "kubara-demo-sandbox" not found

All image-pull-secret secrets across the platform fail to sync, which also causes pods to fail with CreateContainerConfigError since the imagePullSecrets reference is broken.

Expected

Either:

• The ClusterSecretStore/kubara-demo-sandbox should be created as part of kubara generate or the install bootstrap; or
• The install documentation should clearly describe creating the backing secret store before applying the generated manifests; or
• A fallback/stub ClusterSecretStore should be generated for local/sandbox environments.

Workaround

Create a ClusterSecretStore with the fake provider seeding the expected keys:

apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: kubara-demo-sandbox
spec:
  provider:
    fake:
      data:
        - key: docker_config
          value: '{"pull-secret":"{\"auths\":{}}"}'
        - key: grafana_credentials
          value: '{"admin-user":"admin","admin-password":"<password>"}'

[Matthiator]

Thanks for reporting this. We reviewed the issue and agree this bootstrap behavior should be improved or made clearer.

Today’s release is already in progress, so we will not be able to include a change in the current release. We will try to include it in the next release, but cannot promise that yet.

[tuunit]

We agree that we can improve the workflow for ClusterSecretStores and will look into automating this step further in the future.

For the time being please follow the bootstrapping guide. Which clearly states that you need to create your own ClusterSecretStore (which depends on your flavor of choosen secret manager) and apply it to the cluster before running kubara bootstrap

https://docs.kubara.io/latest-stable/1_getting_started/bootstrapping/#41-bootstrap-the-hub-cluster