Bitnami Sealed Secrets

Sealed Secrets consists of three primary components:

1. SealedSecret Custom Resource: A Kubernetes custom resource used to define the desired state of secrets.
2. Controller: A cluster-side operator that manages SealedSecret objects and keeps them in sync with the declared state.
3. kubeseal: A client-side utility that uses asymmetric cryptography to encrypt secrets so that only the controller can decrypt them.

Sealed Secrets allows you to manage Kubernetes configuration in Git by encrypting sensitive Secret resources into SealedSecret resources.

Key characteristics:

• Safe for Git: SealedSecret resources are safe to store in public or private repositories.
• Controller-only Decryption: Only the Sealed Secrets controller running in the target Kubernetes cluster can decrypt the SealedSecret back into a standard Secret.
• One-way Security: Even the original author of the SealedSecret cannot obtain the original Secret from the encrypted version without access to the cluster's controller.

Sealed Secrets consists of two primary components:

1. Cluster-side controller/operator: A component running in your Kubernetes cluster that holds the private key required to decrypt secrets.
2. Client-side utility (kubeseal): A CLI tool used to encrypt standard Kubernetes Secrets into SealedSecret resources using asymmetric cryptography.

Once a SealedSecret is applied to the cluster, the controller automatically unseals it into a standard Kubernetes Secret resource. This allows you to safely store encrypted secrets in public Git repositories.

Before installing Sealed Secrets, ensure your environment meets the following requirements:

• Kubernetes Cluster: version v1.16 or higher.
• kubectl: Installed and configured to communicate with your cluster.
• Helm (for Helm installation): version v3.1.0 or higher, installed and configured.
• kapp (for Carvel installation): Installed and configured to communicate with your cluster.

The Sealed Secrets documentation is organized into several sections to help users find specific information:

• Tutorials: Hands-on introductions for new users starting with Sealed Secrets.
• How-to guides: Step-by-step instructions for addressing specific problems and use-cases.
• Background: Deep dives into the architecture and implementation details.
• Reference: Technical information including developer guides, design proposals, and examples.

To create a SealedSecret from a standard Kubernetes Secret, first generate a JSON or YAML representation of the secret using kubectl, then pipe or pass it to kubeseal.

Important Requirements:

• The SealedSecret and the resulting Secret must have the same namespace and name to prevent cross-user reuse.
• kubeseal determines the namespace by reading the input secret, using the --namespace flag, or falling back to the kubectl default namespace (in that order).
• Labels and annotations on the original Secret are preserved in the secret itself but are not automatically reflected in the SealedSecret resource.

The kubeseal CLI is the client-side utility used to encrypt local Kubernetes secrets into SealedSecret resources. It can be installed via several package managers or from source.

# Homebrew
brew install kubeseal

# MacPorts
port install kubeseal

# Nixpkgs
nix-env -iA nixpkgs.kubeseal

# Linux (Manual download)
# Replace <release-tag> and <version> with actual values (e.g., v0.21.0)
wget https://github.com/bitnami/sealed-secrets/releases/download/<release-tag>/kubeseal-<version>-linux-amd64.tar.gz
tar -xvzf kubeseal-<version>-linux-amd64.tar.gz kubeseal
sudo install -m 755 kubeseal /usr/local/bin/kubeseal

# Go (from source)
go install github.com/bitnami/sealed-secrets/cmd/kubeseal@main

Upgrading to version 2.0.0 involves a major refactoring of the Helm chart structure. While upgrades from previous versions are supported, you must update your values.yaml to match the new schema.

Key breaking changes include:

• controller.create is now createController.
• securityContext.* parameters are deprecated; use podSecurityContext.* and containerSecurityContext.* instead.
• image.repository is split into image.registry and image.repository.
• ingress.hosts[0] is now ingress.hostname.

Note: This version is not compatible with Helm v2.

To use the kube-libsonnet library of Jsonnet manifests for common Kubernetes objects (like Deployment, Service, Ingress, etc.) within your own project, add it as a git submodule. This allows you to include the library's contents in your local lib/ directory.

$ git submodule add https://github.com/bitnami-labs/kube-libsonnet
$ cat .gitmodules
[submodule "lib"]
path = lib
url = https://github.com/bitnami-labs/kube-libsonnet

Use the make command to build the kubeseal binary. The resulting binary will be placed in your current working directory.

make kubeseal