Support kubeseal secrets

[UriZafrir]

Is there an existing issue for this?

• I have searched the existing issues

Affected Resource(s)

s3.aws.upbound.io/v1beta1

Resource MRs required to reproduce the bug

apiVersion: s3.aws.upbound.io/v1beta1
kind: Bucket
metadata:
name: crossplane-bucket-24982734923847hasdkjh
spec:
forProvider:
region: il-central-1
providerConfigRef:
name: default

you can check it out here:
https://github.com/UriZafrir/argocd-autopilot-cluster-2/tree/main/bootstrap/cluster-resources/crossplane

Steps to Reproduce

I'm using sealed secrets,
I've encrypted my secret,
so i have:
sealed-secret.yaml
s3-provider,
and the bucket MR.

What happened?

went according to the quickstart:
https://docs.crossplane.io/latest/getting-started/provider-aws/

filled this file..

[default]
aws_access_key_id = <value>
aws_secret_access_key = <value>

generated a secret:

kubectl create secret generic aws-secret \
  -n crossplane-system \
  --from-file=creds=./aws-credentials.txt \
  --dry-run=client -o yaml > aws-secret.yaml

then used kubeseal:

kubeseal --controller-name=sealed-secrets --controller-namespace=kube-system --format yaml <aws-secret.yaml>sealed-secret.yaml

After creating the bucket, Argocd is in sync, but when describing the bucket i get:

Warning CannotConnectToProvider 32s (x10 over 9m33s) managed/s3.aws.upbound.io/v1beta1, kind=bucket (combined from similar events): cannot initialize the Terraform plugin SDK async external client: cannot get terraform setup: cannot get account id: cannot get the caller identity: GetCallerIdentity query failed: GetCallerIdentity query failed: operation error STS: GetCallerIdentity, https response error StatusCode: 403, RequestID: 0254301b-8c41-46d3-a819-106e50a70490, api error InvalidClientTokenId: The security token included in the request is invalid.

Relevant Error Output Snippet

Warning  CannotConnectToProvider  32s (x10 over 9m33s)  managed/s3.aws.upbound.io/v1beta1, kind=bucket  (combined from similar events): cannot initialize the Terraform plugin SDK async external client: cannot get terraform setup: cannot get account id: cannot get the caller identity: GetCallerIdentity query failed: GetCallerIdentity query failed: operation error STS: GetCallerIdentity, https response error StatusCode: 403, RequestID: 0254301b-8c41-46d3-a819-106e50a70490, api error InvalidClientTokenId: The security token included in the request is invalid.

Crossplane Version

1.19.0-rc.0.79.gea5d79669

Provider Version

xpkg.upbound.io/upbound/provider-aws-s3:v1.17.0

Kubernetes Version

Client Version: v1.30.5+k3s1 Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3 Server Version: v1.30.5+k3s1

Kubernetes Distribution

k3s

Additional Info

No response