<-- Back

mxpc-cli apply-config fails with Vault Secret Operator and ArgoCD: field is immutable

Issue

When attempting to apply Mendix configurations using mxpc-cli apply-config on Private Cloud environments that leverage Vault Secret Operator (VSO) and ArgoCD, an error occurs when VSO/ArgoCD are managing Kubernetes secrets that mxpc-cli also needs to interact with.
 

Environment

Applications hosted in Mendix on Kubernetes

Cause

The mxpc-cli apply-config command is designed to synchronize the namespace configuration with both the Mendix Cloud portal and the Kubernetes cluster. The mxpc-cli tool, adhering to official Kubernetes documentation, creates secrets using the canonical type Opaque whereas VSO/ArgoCD setup could create it with type kubernetes.io/Opaque. A key aspect of Kubernetes Secret resources is that their type field is immutable after creation. When mxpc-cli tries to update a pre-existing secret whose type differs from its expectation, Kubernetes rejects the operation because the type field cannot be modified.

The mxpc-cli apply-config command fails with an error message similar to the following:

-- Applying Kubernetes Secrets...
-- Failed to apply Kubernetes Secrets: failed to update secret proxy_secret: Secret "mendix-proxy" is invalid: type: Invalid value: "Opaque": field is immutable

Solution/Workaround

Currently, there is no direct flag or option to update only the Mendix Private Cloud configuration without applying changes to the cluster. However, the following workaround is available:

  1. Ensure that VSO and ArgoCD configurations create secrets with the type Opaque instead of kubernetes.io/Opaque.  While kubernetes.io/Opaque and Opaque effectively refer to the same underlying secret behavior, Kubernetes treats them as distinct string values for the type field. 

  2. After updating VSO/ArgoCD configuration, delete any existing secrets that have the incorrect type: kubernetes.io/Opaque before running mxpc-cli apply-config

  3. If modifying the secret type is not possible in the current setup, delete the existing secrets and allow mxpc-cli to recreate them with the correct type and then manually reconcile the differences to match the secret type with VSO/ArgoCD setup.

Internal information related

  • 264938

Additional information

Have more questions? Submit a request

0 Comments

Article is closed for comments.

To provide feedback, please open a ticket here. Don't forget to include the article's URL along with the feedback you would like to provide.