bitnami-labs/sealed-secrets

★ 9,089GoAudience · ops devopsComplexity · 4/5Setup · moderate

Mindmap

mindmap
  root((Sealed Secrets))
    Problem solved
      Safe secrets in Git
      Encrypted at rest
    How it works
      kubeseal CLI
      In-cluster controller
      Public key encryption
    Scopes
      Namespace locked
      Cluster wide
    Features
      Key rotation
      Backup and recovery
      Helm and Kustomize

mindmap root((Sealed Secrets)) Problem solved Safe secrets in Git Encrypted at rest How it works kubeseal CLI In-cluster controller Public key encryption Scopes Namespace locked Cluster wide Features Key rotation Backup and recovery Helm and Kustomize

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Safely commit encrypted Kubernetes secrets to a public Git repository as part of a GitOps workflow.

USE CASE 2

Lock a sealed secret to a specific namespace so another team's deployment cannot accidentally use it.

USE CASE 3

Set up automatic encryption key rotation in your cluster without manually re-creating secrets.

USE CASE 4

Back up the cluster's private key so secrets can be recovered if the cluster is lost.

Tech stack

GoKubernetesHelmKustomize

Getting it running

Difficulty · moderate Time to first run · 30min

Requires a running Kubernetes cluster, the in-cluster controller must be deployed before you can create or decrypt any SealedSecrets.

In plain English

Sealed Secrets solves a specific problem that teams using Kubernetes (a system for running containerized applications) run into when they want to store all their configuration in a version control system like Git: regular Kubernetes secrets are only base64-encoded, not encrypted, so you cannot safely commit them to a repository, especially a public one. Anyone who can read the file can read the secret. The project provides a way to encrypt secrets before they go into Git so that the encrypted version is safe to store anywhere. The encrypted file is called a SealedSecret. When you apply it to your Kubernetes cluster, a controller running inside the cluster decrypts it and creates the real secret automatically. Only that controller can perform the decryption, so even the person who created the SealedSecret cannot reverse it outside the cluster. The system has two pieces: a controller that runs inside the cluster and handles decryption, and a command-line tool called kubeseal that you run on your own machine to do the encryption. You pipe your regular Kubernetes secret into kubeseal, it contacts the cluster to fetch the public key, encrypts the data, and outputs a SealedSecret file that you can safely commit. The controller holds the matching private key and never exposes it. Scopes let you control where a sealed secret can be used: locked to a specific namespace and name, locked to a specific namespace but any name, or usable cluster-wide. This prevents one team from accidentally using another team's secrets. The controller rotates its encryption keys on a schedule and can re-encrypt older sealed secrets with the new key. Backup and manual key management options are documented for cases where you need to recover secrets without cluster access. Installation options include Helm, Kustomize, Homebrew, and pre-built binaries for Linux and macOS. The full README is longer than what was shown.

Copy-paste prompts

Prompt 1

I have a Kubernetes secret YAML file. Show me how to use kubeseal to encrypt it into a SealedSecret I can safely commit to GitHub.

Prompt 2

How do I install the Sealed Secrets controller into my Kubernetes cluster using Helm?

Prompt 3

I want to lock a SealedSecret so only one specific namespace and deployment can use it. Which kubeseal scope option do I set?

Prompt 4

How do I back up the Sealed Secrets private key so I can restore my secrets if the cluster is destroyed?

Open on GitHub → Explain another repo

← bitnami-labs on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.