sealed-secrets

Sealed Secrets

Overview

Sealed Secrets provides one-way encryption for Kubernetes Secrets. A SealedSecret custom resource can be safely stored in public Git repos. Only the controller running in the target cluster can decrypt it, recovering the original Secret.

CRD: SealedSecret (bitnami.com/v1alpha1).

Latest: chart 2.18.5, controller v0.36.6 (Apr 2026).

Architecture

Developer workstation:
  kubeseal --fetch-cert         ← fetches controller's public key
    → creates SealedSecret YAML   ← encrypts Secret data with public key
      → committed to Git

Cluster controller:
  watches SealedSecret resources
    → decrypts using private key
      → creates/reconciled K8s Secret

CRD: SealedSecret

apiVersion: bitnami.com/v1alpha1, kind: SealedSecret

apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: mysecret
  namespace: myapp
spec:
  encryptedData:
    password: AgBy7x...base64-encrypted...
  template:
    metadata:
      labels:
        app: myapp
    type: Opaque   # or kubernetes.io/dockerconfigjson, etc.

Key fields:

Field	Description
spec.encryptedData	Map of key → encrypted value (the sealed ciphertext)
spec.template.metadata	Labels/annotations applied to the decrypted Secret
spec.template.type	Secret type (Opaque, kubernetes.io/dockerconfigjson, etc.)
spec.template.data	Unencrypted key-value pairs merged into the output Secret

The namespace in metadata.namespace is binding — the controller will only create the Secret in the same namespace as the SealedSecret.

kubeseal CLI

Install

# Linux amd64
wget https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.36.6/kubeseal-0.36.6-linux-amd64.tar.gz
tar xzf kubeseal-*-linux-amd64.tar.gz
sudo install kubeseal /usr/local/bin/

Common Operations

# Fetch the public certificate (for offline sealing)
kubeseal --fetch-cert \
  --controller-name=sealed-secrets-controller \
  --controller-namespace=kube-system \
  > pub-cert.pem

# Seal a Secret from stdin
kubectl create secret generic mysecret \
  --dry-run=client -o yaml \
  --from-literal=password=my-value \
  | kubeseal \
    --controller-name=sealed-secrets-controller \
    --controller-namespace=kube-system \
    --format=yaml \
  > mysealedsecret.yaml

# Seal offline (no cluster access needed)
kubectl create secret generic mysecret \
  --dry-run=client -o yaml \
  --from-literal=password=my-value \
  | kubeseal \
    --cert=pub-cert.pem \
    --format=yaml \
  > mysealedsecret.yaml

# Re-encrypt existing SealedSecret with latest key
kubeseal --re-encrypt \
  --controller-name=sealed-secrets-controller \
  --controller-namespace=kube-system \
  < mysealedsecret.yaml \
  > mysealedsecret-reencrypted.yaml

# Validate a SealedSecret
kubeseal --validate \
  --controller-name=sealed-secrets-controller \
  --controller-namespace=kube-system \
  < mysealedsecret.yaml

# Merge with existing Secret (update individual keys)
# Create new SealedSecret with only the changed key, controller patches it