Encryption/Decryption problem

[clickersmudge]

Hi,
I would like to report an error.

When I run a new installation of KubeOne with the configuration.

kubeone.yaml

apiVersion: kubeone.k8c.io/v1beta2
kind: KubeOneCluster
versions:
    kubernetes: "v1.27.11"
clusterNetwork:
    cni:
        canal:
            mtu: 1400
cloudProvider:
    hetzner: {}
    external: true
features:
    encryptionProviders:
        enable: true

Everything works.

However, when I change

features:
    encryptionProviders:
        enable: false

and run

kubeone apply --credentials credentials.yaml --manifest kubeone.yaml --tfjson tf.json --force-upgrade

I have an error

WARN[15:17:26 CET] Retrying task...                             
INFO[15:17:26 CET] Creating machine-controller credentials secret... 
WARN[15:17:26 CET] Task failed, error was: kubernetes: getting *v1.Secret kube-system/kubeone-machine-controller-credentials
Internal error occurred: identity transformer tried to read encrypted data 
WARN[15:18:42 CET] Retrying task...                             
INFO[15:18:42 CET] Creating machine-controller credentials secret... 
WARN[15:18:42 CET] Task failed, error was: kubernetes: getting *v1.Secret kube-system/kubeone-machine-controller-credentials
Internal error occurred: identity transformer tried to read encrypted data 
WARN[15:20:27 CET] Retrying task...                             
INFO[15:20:28 CET] Creating machine-controller credentials secret... 
WARN[15:20:28 CET] Task failed, error was: kubernetes: getting *v1.Secret kube-system/kubeone-machine-controller-credentials
Internal error occurred: identity transformer tried to read encrypted data 
WARN[15:22:56 CET] Retrying task...                             
INFO[15:22:56 CET] Creating machine-controller credentials secret... 
WARN[15:22:56 CET] Task failed, error was: kubernetes: getting *v1.Secret kube-system/kubeone-machine-controller-credentials
Internal error occurred: identity transformer tried to read encrypted data 

[xmudrii]

@clickersmudge Created #3097 to track this

[clickersmudge]

@xmudrii Hi,
With reference to "if not possible, warn users to manually decrypt Secrets and provide instructions for that"
Can you help us with simple instructions on how to decrypt the secrets to restore the backup? Before official documentation is created?