Why does SmallRye JWT sign() fail when loading keys from a Kubernetes secret in Quarkus?

I'm developing a Quarkus REST application to sign and validate JWT tokens, and I want to store the private and public keys as Kubernetes secrets.

Here's what I did:

• Generated the keys using openssl

BASHCopied
openssl genrsa -out keypair.pem 2048
openssl rsa -in keypair.pem -pubout -out publickey.crt
openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in keypair.pem -out pkcs8.key

• Created a Kubernetes secret

BASHCopied
kubectl create secret generic jwt-keys -n my-namespace --from-file=privkey=pkcs8.key --from-file=pubkey=publickey.crt

• Edited application.properties

PROPERTIESCopied
quarkus.kubernetes-config.secrets=jwt-keys
mp.jwt.sign.key=jwt-keys.privkey
mp.jwt.verify.publickey=jwt-keys.pubkey
smallrye.jwt.sign.key=jwt-keys.privkey

• Attempted to sign a token with the following method

JAVACopied
    private String createToken(Role role) {
        long now = Instant.now().getEpochSecond();
        long exp = now + TimeUnit.MINUTES.toSeconds(60);
        return Jwt.issuer(issuer)
                .claim(Claims.groups, role)
                .issuedAt(Instant.ofEpochSecond(now))
                .expiresAt(Instant.ofEpochSecond(exp))
                .sign();
    }

When I call createToken, I get the following error:

PLAINTEXTCopied
io.smallrye.jwt.build.JwtSignatureException: SRJWT05009:
        at io.smallrye.jwt.build.impl.JwtSignatureImpl.sign(JwtSignatureImpl.java:109)
        at de.infinityq.auth.TokenManager.createToken(TokenManager.java:21)
        at de.infinityq.auth.TokenManager.createUserToken(TokenManager.java:29)ethod:
...
Caused by: java.lang.IllegalArgumentException: SRJWT05028: Signing key can not be created from the loaded content
        at io.smallrye.jwt.build.impl.JwtSignatureImpl.sign(JwtSignatureImpl.java:102)

This indicates that the key content from the Kubernetes secret isn’t being parsed as a valid PKCS#8 private key. I verified the key files work when passed directly (following the Quarkus JWT guide: https://quarkus.io/guides/security-jwt#token-decryption) and confirmed with the SmallRye documentation (https://smallrye.io/docs/smallrye-jwt/generate-jwt.html) that passing the key as a value should work.

I’m not sure what else to try. Any insight into why the sign function crashes when reading the key from the Kubernetes secret?

EDIT:

Below is the content of the jwt-keys secret (for local testing, these keys will be replaced anyway):

JSONCopied
{
    "apiVersion": "v1",
    "data": {
        "privkey": "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQ2RuUStWWTdaUll2R1gKRTJ5Njh0cmxud29BYlpmZENuYWpEanJBQTBvaDRXSjR5Yy9ObVNlWUZ6cm1oaUlnaUZtdGtKMVBxNW5hRDloMQpZU0U1MEpXS1F0ZXB1TEFaSkpTNk15QVgrcWJRL2s5ZEpMaGx4WXliVzBFTWlZSjdQMCtOOWcwL05iTGR3VlpvCmd1S3RpTjNhcXpkMjUwMzNNNUpzdjhVQVVnOTBxQUZ1ZWVxZTE4OENsb0hqaHZRZFpJMEhMZlNwRC9TaktnS2QKdXlNcTRjelZwV2ZUZnJhWkZDcWNlNU92SVJzTkhLMDQ2b1RDY1ErL25TdmgzemQ0dnpubGRpYjkra2JrOG9xSApKQSswSUl3YXVXcWQyVUtCYmhvdG91aEsvUEZxcmpNbW1jVXFwenZic3VlL3Npay9sTkdvK0FmWGdjd0dlTE1kCkRPTVlqbmc5QWdNQkFBRUNnZ0VBQ1IwVFVScU9hTDlWWTl4eUxZOHNYQm1wbk9PNVk4VWVuZ2dOR3B3MkZhWncKS0xiV3ByZEQ1RlgzaUd2YUhsSjBDUWF6S2Urc3VrQ3ZUZjQ3U3hvR0E1UWczMFg0SE1RU080QUlTNHFwU2ExaQp6bXA0cFIzYXB3TU1URnJKS2pJN2VlUnYyS2RVdStEWmk3cUJ1L0lOamY3WGVxOGVRWHlBYTN4ZE9rc0ViTVRRCjhDb2NGWXN0Zit2ajhvaWNtaFQ1c2dWdDhBeCtFMlMyNzRQcituMFEvbDhuN1hRVnhZbEFuMXdPMmw0YnVEUHYKQ2puQU1sMkhXN2IyUHU0NnpwYUs4aFJwY012UEJBTzhUVHNwYjAwVTBYcU9rSFNHT1BjR2Jjb3F4ZklQK3dNawo2dzh2OFp3SnlRajlvNTZOYW1aRXdvKzkwOURBMzdTU0F0NytZRVBtK3dLQmdRRE5MUSsrb0VQMExRaUhDb2YzCklEWFY5U0h5OVdkc2xLODdkUUsvUmw4WUtQSEFpKy9mVmQ2V01nQk9ka2k0bnBNbjVNTHdGaXRoa0FpcnBGcmgKaW5RcXNabEVLV1l5RHBJY1NvWXRZQU5HTkZTOVR3cE5zS01jQkpmNHI0b0xRRHMrWXBXSGoydkUyODVWTUtnNApabWVSc0M0QjlGbnRGRlpBd0pzRnN0SkJld0tCZ1FERXArUi9VRE0vaExMWERHOXNyYUdTNVIxRkRrRWhSM242CmxqUHk2YXp0eSsrV25xdGVJTW5SbEZwOTUrSVNvTkpVSy9DUCtGTHduQjZXRVY4UUgvMTRXQU94OExMRG5VYVIKeGVRaFU0RlpERHVJZEtyRXdEbW52SEVCNkRQWFptVlFqeTV0dUNXbTB0bEhiaGZBNHpJOCtpUGc5dkdsSjc1SQpHLzgxQ0ZyenB3S0JnRGM3VENPNnJOQk1WeUZUR21yU0J1d0R3eEhPTWZzdXcwVTBLSHNwREd4S2lWbVYwZ3JDCjZOcHh0MWRuekFlMjJGSkM2SjhNdUx6WXN4elJiNDJMWWQ0a1ZPZmVaUjVRZ2RDUDF6TGJ4OFhjVEh0eGpZcUEKWkVna2pHeHJoTE9tcE13VWFjQkdRWEtLNFM1Wm5NOGg4ZnRyKzlhVzJxWlJkUzZWS3FZTUQwR0ZBb0dBUWcwUwpGaURkMWF2QVZiSjdpa2tYUjd0a2hWa3dUdmt1NHhlb0F5S3hUbjE4ejE0anVNM1NlMjRVcHMxSGhYSTJzc2EvCldkdlNIN2FRSDE5ZVNwQTBGa09abWg1NkxIR2F6a05zU0R3LzZhVE9LaHJsY0lnUDFXTFpvZ1pYd3pWRk9qV2QKSm9UL1FIVDVQYUNnb2N5dGh3V05IM1pSMjJMcDZsWmM5WGNFOVdrQ2dZQURHeXp0S1VTRTZ1VEJrKzBBWjZENgpjejVGNjJaRW8xS2xaMkNsSWNMMXNRQ0dLR2M4VzJLNnN4OFJ3NlEyZm1BNEk5eGVqNkpUaXZNbXc3NVJ3VC9oCm9mWGZvVW0xdWZBUDRFL1MzQ281d2hPdldiOEpBOEpBOXVrMzEzcE1sVFpXeUwxcElLczVMdzlsVDZoLzRmZHcKY1JMZmwxQms1dWk1TVRXSm9pYzYrZz09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K",
        "pubkey": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFuWjBQbFdPMlVXTHhseE5zdXZMYQo1WjhLQUcyWDNRcDJvdzQ2d0FOS0llRmllTW5Qelprbm1CYzY1b1lpSUloWnJaQ2RUNnVaMmcvWWRXRWhPZENWCmlrTFhxYml3R1NTVXVqTWdGL3FtMFA1UFhTUzRaY1dNbTF0QkRJbUNlejlQamZZTlB6V3kzY0ZXYUlMaXJZamQKMnFzM2R1ZE45ek9TYkwvRkFGSVBkS2dCYm5ucW50ZlBBcGFCNDRiMEhXU05CeTMwcVEvMG95b0NuYnNqS3VITQoxYVZuMDM2Mm1SUXFuSHVUcnlFYkRSeXRPT3FFd25FUHY1MHI0ZDgzZUw4NTVYWW0vZnBHNVBLS2h5UVB0Q0NNCkdybHFuZGxDZ1c0YUxhTG9Tdnp4YXE0ekpwbkZLcWM3MjdMbnY3SXBQNVRScVBnSDE0SE1Cbml6SFF6akdJNTQKUFFJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg=="
    },
    "kind": "Secret",
    "metadata": {
        "creationTimestamp": "2025-01-20T12:34:19Z",
        "name": "jwt-keys",
        "namespace": "my-namespace",
        "resourceVersion": "6222080",
        "uid": "f3e1cb39-4e95-4af0-bef2-4eabf87e4777"
    },
    "type": "Opaque"
}