Disabling encryptionProviders doesn't decrypt Secrets automatically

[xmudrii]

Discussed in #3095

^{Originally posted by clickersmudge March 25, 2024}
Hi,
I would like to report an error.

When I run a new installation of KubeOne with the configuration.

kubeone.yaml

apiVersion: kubeone.k8c.io/v1beta2
kind: KubeOneCluster
versions:
    kubernetes: "v1.27.11"
clusterNetwork:
    cni:
        canal:
            mtu: 1400
cloudProvider:
    hetzner: {}
    external: true
features:
    encryptionProviders:
        enable: true

Everything works.

However, when I change

features:
    encryptionProviders:
        enable: false

and run

kubeone apply --credentials credentials.yaml --manifest kubeone.yaml --tfjson tf.json --force-upgrade

I have an error

WARN[15:17:26 CET] Retrying task...                             
INFO[15:17:26 CET] Creating machine-controller credentials secret... 
WARN[15:17:26 CET] Task failed, error was: kubernetes: getting *v1.Secret kube-system/kubeone-machine-controller-credentials
Internal error occurred: identity transformer tried to read encrypted data 
WARN[15:18:42 CET] Retrying task...                             
INFO[15:18:42 CET] Creating machine-controller credentials secret... 
WARN[15:18:42 CET] Task failed, error was: kubernetes: getting *v1.Secret kube-system/kubeone-machine-controller-credentials
Internal error occurred: identity transformer tried to read encrypted data 
WARN[15:20:27 CET] Retrying task...                             
INFO[15:20:28 CET] Creating machine-controller credentials secret... 
WARN[15:20:28 CET] Task failed, error was: kubernetes: getting *v1.Secret kube-system/kubeone-machine-controller-credentials
Internal error occurred: identity transformer tried to read encrypted data 
WARN[15:22:56 CET] Retrying task...                             
INFO[15:22:56 CET] Creating machine-controller credentials secret... 
WARN[15:22:56 CET] Task failed, error was: kubernetes: getting *v1.Secret kube-system/kubeone-machine-controller-credentials
Internal error occurred: identity transformer tried to read encrypted data 

[xmudrii]

I see two options:

• Automatically decrypt Secrets upon disabling encryptionProviders
• if not possible, warn users to manually decrypt Secrets and provide instructions for that

[xmudrii]

Also relevant to #3096

[clickersmudge]

Probably also revelant to #3098