tldr/pages/common/kubeseal.md

kubeseal

Client-side utility for encrypting Kubernetes secrets using the Bitnami Sealed Secrets controller. Creates SealedSecret resources that can be safely stored in version control. Requires a controller running in the cluster (e.g., installed via kubectl apply -f controller.yaml). More information: https://github.com/bitnami-labs/sealed-secrets.

• Encrypt a Kubernetes secret from a YAML file into a SealedSecret (default JSON output):

kubeseal < {{secret.yaml}} > {{sealedsecret.json}}

• Encrypt a secret, outputting it in YAML or JSON format, using a bearer token for API authentication:

kubeseal {{[-o|--format]}} {{yaml|json}} --token {{my-bearer-token}} < {{secret.yaml}} > {{sealedsecret.yaml}}

• Seal a secret using a specific controller namespace of sealed-secrets controller and name:

kubeseal --controller-namespace {{controller-namespace}} --controller-name {{controller-name}} < {{secret.yaml}} > {{sealedsecret.yaml}}

• Encrypt a raw secret value from a file with a specified name and scope:

kubeseal --raw --from-file {{path/to/secret.txt}} --name {{my-secret}} --scope {{strict|namespace-wide|cluster-wide}} > {{sealedsecret.yaml}}

• Fetch the controller's public certificate for offline sealing with basic auth:

kubeseal --fetch-cert --username {{username}} --password {{password}} > {{cert.pem}}

• Seal a secret offline using a fetched certificate:

kubeseal --cert {{cert.pem}} < {{secret.yaml}} > {{sealedsecret.yaml}}

• Merge a secret into an existing SealedSecret file in-place:

kubeseal --merge-into {{sealedsecret.yaml}} < {{secret.yaml}}

• Validate a SealedSecret without applying it:

kubeseal --validate < {{sealedsecret.yaml}}