Kubeseal: Seal and Reseal Kubernetes Secrets

Overview

Seal Kubernetes Secrets into Bitnami SealedSecrets that are safe to store in Git. SealedSecrets are asymmetrically encrypted — anyone can encrypt (seal), but only the sealed-secrets controller in the cluster can decrypt (unseal).

Validated against kubeseal v0.38.4. Flag names are stable across recent releases, but run kubeseal --help if a command behaves unexpectedly.

Key insight: the public certificate (tls.crt) is not secret — it is a public key, safe to share and even commit. Only the controller's private key (tls.key) is sensitive. Sealing is a purely local, offline operation once you have the cert; no cluster access is needed to seal.

CRITICAL SECURITY RULES

NEVER LEAK CREDENTIALS