Problem:
The GRID_SWIM_ENCRYPT_KEY env var accepts a 64-character hex string (representing 32 bytes). The GridNetwork.spec.tls.swimKeyRef
CRD path reads raw bytes from the Kubernetes Secret and expects exactly 32 bytes. Storing the hex string in the Secret results in 64 bytes,
rejected with:
swimKeyRef key must be exactly 32 bytes; SWIM key not applied ... len=64
Workaround:
Store the key as raw binary (not hex) in the Secret:
echo -n "$HEX_KEY" | xxd -r -p | oc -n grid-system create secret generic grid-swim-key --from-file=key=/dev/stdin
Proposed fix:
Accept both raw binary (32 bytes) and hex string (64 chars) in the swimKeyRef path, consistent with the env var behavior.
Problem:
The
GRID_SWIM_ENCRYPT_KEYenv var accepts a 64-character hex string (representing 32 bytes). TheGridNetwork.spec.tls.swimKeyRefCRD path reads raw bytes from the Kubernetes Secret and expects exactly 32 bytes. Storing the hex string in the Secret results in 64 bytes,
rejected with:
Workaround:
Store the key as raw binary (not hex) in the Secret:
Proposed fix:
Accept both raw binary (32 bytes) and hex string (64 chars) in the
swimKeyRefpath, consistent with the env var behavior.