Sealed Secrets is a Kubernetes controller and command-line tool that solves the problem of managing sensitive data in version control systems. The core issue it addresses is that while Kubernetes configuration can be stored in git repositories, native Kubernetes Secrets cannot be safely committed to version control, especially public repositories. Sealed Secrets encrypts secrets into SealedSecret resources that are safe to store anywhere, including public git repositories, because they can only be decrypted by the specific controller running in the target cluster.
The project consists of two main components: a cluster-side controller that runs as an operator within Kubernetes, and a client-side utility called kubeseal that users interact with locally. The kubeseal tool uses asymmetric cryptography to encrypt secrets, with the public key available for encryption operations and the private key held exclusively by the controller for decryption. This one-way encryption model ensures that even the original author of a sealed secret cannot decrypt it without access to the target cluster.
SealedSecret resources function as templates for generating standard Kubernetes Secrets. When a SealedSecret is applied to a cluster, the controller automatically decrypts it and creates the corresponding Secret resource, which can then be referenced by pods and other Kubernetes objects. The SealedSecret resource maintains a template section that controls how the unsealed Secret is generated, including metadata, labels, annotations, and the data fields themselves. The controller supports templating complex values using the Sprig function library.
A critical security feature of Sealed Secrets is its scope mechanism. Secrets are encrypted with the namespace name and secret name included in the encryption process, preventing users from moving a sealed secret between namespaces or renaming it to decrypt secrets they shouldn't have access to. This design respects Kubernetes RBAC configurations where users may have access to specific secrets in specific namespaces but not others.
The project provides flexible installation options including direct Kubernetes manifests, Kustomize, and Helm charts, with support for restricted environments without RBAC. The kubeseal utility is available through multiple package managers including Homebrew, MacPorts, and Nixpkgs, as well as direct Linux installation and compilation from source.
According to GitGenius activity tracking, the repository shows strong maintenance with a median issue and pull request response latency of 0.0 hours across 99 tracked items, though the mean response time of 534.8 hours indicates some items receive delayed attention. The most active labels are triage with 32 occurrences, backlog with 27, and enhancement with 22, reflecting ongoing development and community engagement. The primary contributors tracked are alvneiayu with 122 events, agarcia-oss with 97 events, and juan131 with 58 events. The repository's contributor overlap with major projects like microsoft/vscode, microsoft/typescript, and rust-lang/rust indicates its significance within the broader open-source ecosystem.
The project supports advanced features including secret rotation, sealing key renewal with automatic 30-day certificate rotation, manual key management, and re-encryption capabilities. Users can manage secrets across entire clusters or specific namespace subsets, validate sealed secrets before deployment, and configure controller unseal retry behavior. The documentation includes comprehensive FAQ coverage addressing backup strategies, offline decryption capabilities, and integration with various configuration file formats.
