<p>I am trying to deploy consul using kubernetes <code>StatefulSet</code> with following manifest</p>
<pre><code>---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: consul
  labels:
    app: consul
rules:
  - apiGroups: [&quot;&quot;]
    resources:
      - pods
    verbs:
      - get
      - list

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: consul
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: consul
subjects:
  - kind: ServiceAccount
    name: consul
    namespace: dev-ethernet

---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: consul
  namespace: dev-ethernet
  labels:
    app: consul

---

apiVersion: v1
kind: Secret
metadata:
  name: consul-secret
  namespace: dev-ethernet
data:
  consul-gossip-encryption-key: &quot;aIRpNkHT/8Tkvf757sj2m5AcRlorWNgzcLI4yLEMx7M=&quot;

---

apiVersion: v1
kind: ConfigMap
metadata:
  name: consul-config
  namespace: dev-ethernet
data:
  server.json: |
    {
      &quot;bind_addr&quot;: &quot;0.0.0.0&quot;,
      &quot;client_addr&quot;: &quot;0.0.0.0&quot;,
      &quot;disable_host_node_id&quot;: true,
      &quot;data_dir&quot;: &quot;/consul/data&quot;,
      &quot;log_level&quot;: &quot;INFO&quot;,
      &quot;datacenter&quot;: &quot;us-west-2&quot;,
      &quot;domain&quot;: &quot;cluster.local&quot;,
      &quot;ports&quot;: {
        &quot;http&quot;: 8500
      },
      &quot;retry_join&quot;: [
        &quot;provider=k8s label_selector=\&quot;app=consul,component=server\&quot;&quot;
      ],
      &quot;server&quot;: true,
      &quot;telemetry&quot;: {
        &quot;prometheus_retention_time&quot;: &quot;5m&quot;
      },
      &quot;ui&quot;: true
    }

---

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: consul
  namespace: dev-ethernet
spec:
  selector:
    matchLabels:
      app: consul
      component: server
  serviceName: consul
  podManagementPolicy: Parallel
  replicas: 3
  updateStrategy:
    rollingUpdate:
      partition: 0
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: consul
        component: server
      annotations:
        consul.hashicorp.com/connect-inject: &quot;false&quot;
    spec:
      serviceAccountName: consul
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: app
                    operator: In
                    values:
                      - consul
              topologyKey: kubernetes.io/hostname
      terminationGracePeriodSeconds: 10
      securityContext:
        fsGroup: 1000
      containers:
        - name: consul
          image: &quot;consul:1.8&quot;
          args:
            - &quot;agent&quot;
            - &quot;-advertise=$(POD_IP)&quot;
            - &quot;-bootstrap-expect=3&quot;
            - &quot;-config-file=/etc/consul/config/server.json&quot;
            - &quot;-encrypt=$(GOSSIP_ENCRYPTION_KEY)&quot;
          env:
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: GOSSIP_ENCRYPTION_KEY
              valueFrom:
                secretKeyRef:
                  name: consul-secret
                  key: consul-gossip-encryption-key
          volumeMounts:
            - name: data
              mountPath: /consul/data
            - name: config
              mountPath: /etc/consul/config
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/sh
                - -c
                - consul leave
          ports:
            - containerPort: 8500
              name: ui-port
            - containerPort: 8400
              name: alt-port
            - containerPort: 53
              name: udp-port
            - containerPort: 8080
              name: http-port
            - containerPort: 8301
              name: serflan
            - containerPort: 8302
              name: serfwan
            - containerPort: 8600
              name: consuldns
            - containerPort: 8300
              name: server
      volumes:
        - name: config
          configMap:
            name: consul-config
  volumeClaimTemplates:
  - metadata:
      name: data
      labels:
        app: consul
    spec:
      accessModes: [ &quot;ReadWriteOnce&quot; ]
      storageClassName: aws-gp2
      resources:
        requests:
          storage: 3Gi
</code></pre>
<p>But gets <code>==&gt; encrypt has invalid key: illegal base64 data at input byte 1</code> when container starts.</p>
<p>I have generated consul-gossip-encryption-key locally using <code>docker run -i -t consul keygen</code></p>
<p>Anyone knows whats wrong here ?</p>

roy
<p>secret.data must be <code>base64</code> string.</p>
<p>try</p>
<pre><code>kubectl create secret generic consul-gossip-encryption-key --from-literal=key=&quot;$(docker run -i -t consul keygen)&quot; --dry-run -o=yaml
</code></pre>
<p>and replace</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: consul-secret
  namespace: dev-ethernet
data:
  consul-gossip-encryption-key: &quot;aIRpNkHT/8Tkvf757sj2m5AcRlorWNgzcLI4yLEMx7M=&quot;
</code></pre>
<p>ref: <a href="https://www.consul.io/docs/k8s/helm#v-global-gossipencryption" rel="nofollow noreferrer">https://www.consul.io/docs/k8s/helm#v-global-gossipencryption</a></p>
