Seal Kubernetes Secrets into Git-safe manifests with kubeseal
Encrypt Kubernetes Secret manifests against a Sealed Secrets controller so agents can commit cluster-targeted secrets to Git without exposing plaintext.
Prerequisites
kubeseal CLI, access to the target Sealed Secrets controller certificate or cluster, kubectl-compatible Secret manifest input
Installation
Use the upstream install or setup path that matches your environment:
- brew install kubeseal
- go install github.com/bitnami-labs/sealed-secrets/cmd/kubeseal@main
Requirements and caveats from upstream:
- (requires secure access to the Kubernetes API server), which is
- A cluster administrator must have already installed the SealedSecret CRDs.
Basic usage or getting-started notes:
The Usage section explores in more detail how you craft SealedSecret resources.
Extracted from upstream docs: https://raw.githubusercontent.com/bitnami-labs/sealed-secrets/HEAD/README.md