Sealed Secrets — One-Way Encrypted Kubernetes Secrets

What it is

Sealed Secrets is a Kubernetes controller and CLI tool from Bitnami Labs that enables GitOps-safe secret management. It lets you encrypt Kubernetes Secrets into SealedSecret resources that are safe to commit to Git. The cluster-side controller decrypts them into real Secrets at apply time.

Sealed Secrets solves the fundamental GitOps problem: you want all configuration in Git, but Kubernetes Secrets are base64-encoded (not encrypted) and cannot be safely committed.

How it saves time or tokens

Without Sealed Secrets, teams either avoid GitOps for secrets (manual kubectl apply) or use complex external secret managers. Sealed Secrets adds encryption directly to the GitOps workflow. Encrypt once with kubeseal, commit the SealedSecret, and the controller handles decryption.

This eliminates the operational overhead of managing secrets separately from other Kubernetes configurations.

Additionally, the project's well-structured documentation and active community mean developers spend less time troubleshooting integration issues. When AI coding assistants generate code for this tool, they can reference established patterns from the documentation, producing correct implementations with fewer iterations and lower token costs.

How to use

1. Install the controller in your cluster:

helm repo add sealed-secrets https://bitnami-labs.github.io/sealed-secrets
helm install sealed-secrets sealed-secrets/sealed-secrets -n kube-system

1. Install the kubeseal CLI:

brew install kubeseal

1. Create and seal a secret:

kubectl create secret generic my-secret \
  --from-literal=api-key=super-secret-value \
  --dry-run=client -o yaml | \
  kubeseal --format yaml > sealed-secret.yaml

1. Commit sealed-secret.yaml to Git. The controller decrypts it into a real Secret when applied.

kubectl apply -f sealed-secret.yaml

Example

# sealed-secret.yaml (safe to commit)
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: my-secret
  namespace: default
spec:
  encryptedData:
    api-key: AgBy3i4OJSWK+PiTySYZZA9rO43cGDEq...
  template:
    metadata:
      name: my-secret

Related on TokRepo

• AI Tools for Security — Security tools for Kubernetes and cloud
• AI Tools for DevOps — Kubernetes configuration management

Common pitfalls

• Losing the controller's private key. If the controller's private key is lost, all existing SealedSecrets become undecryptable. Back up the key securely or use a key management service.
• Not specifying the namespace when sealing. By default, SealedSecrets are namespace-scoped. A SealedSecret sealed for namespace A cannot be decrypted in namespace B.
• Committing raw Secrets alongside SealedSecrets. The SealedSecret replaces the regular Secret. Never commit unencrypted Secret YAML to the same repository.
• Failing to review community discussions and changelogs before upgrading. Breaking changes in major versions can disrupt existing workflows. Pin versions in production and test upgrades in staging first.