sealed-secrets

Sealed Secrets is a Kubernetes controller and client tool (kubeseal) that encrypts Secret resources into SealedSecret custom resources. These encrypted resources are safe to commit to Git or share publicly, because only the controller running in the target cluster can decrypt them back into regular Kubernetes Secrets. The encryption uses asymmetric cryptography, so even the original author cannot recover the secret from the SealedSecret. SealedSecrets can be scoped to strict (same name and namespace), namespace-wide, or cluster-wide. The controller generates and periodically rotates its own key pair. kubeseal fetches the controller certificate at runtime or works offline with a stored certificate. Installation is supported via kubectl manifests, Helm chart, Kustomize, and package managers like Homebrew, MacPorts, and Nixpkgs. The tool supports secret rotation, patching existing secrets, raw mode, and validation. It is designed for GitOps workflows where secret contents must remain hidden while configuration lives in version control.