Sealed Secrets

Overview

Sealed Secrets provides one-way encryption for Kubernetes Secrets. A SealedSecret custom resource can be safely stored in public Git repos. Only the controller running in the target cluster can decrypt it, recovering the original Secret.

CRD: SealedSecret (bitnami.com/v1alpha1).

Latest: chart 2.18.5, controller v0.36.6 (Apr 2026).

Architecture

Developer workstation:
  kubeseal --fetch-cert         ← fetches controller's public key
    → creates SealedSecret YAML   ← encrypts Secret data with public key
      → committed to Git