Skip to content

Sealed Secrets

Generate from Literal

kubectl create secret generic <NAME> \
--namespace <NAMESPACE> \
--from-literal=<SECRET_KEY>=<SECRET_VALUE> \
--dry-run=client -o yaml \
| kubeseal --controller-namespace flux-system --format yaml \
> <OUTPUT_FILE>.yaml

kubectl create secret generic mysecret \
--namespace mynamespace \
--from-literal=password=supersecret \
--dry-run=client -o yaml \
| kubeseal --controller-namespace flux-system --format yaml \
> mysealedsecret.yaml
sealed-secret.yaml
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: <NAME>
namespace: <NAMESPACE>
spec:
encryptedData:
    <SECRET_KEY>: <ENCRYPTED_VALUE>
template:
    metadata:
    name: <NAME>
    namespace: <NAMESPACE>

Generate from File

# Create a json/yaml-encoded Secret somehow:
# (note use of `--dry-run` - this is just a local file!)
echo -n bar | kubectl create secret generic mysecret --dry-run=client --from-file=foo=/dev/stdin -o json >mysecret.json

# This is the important bit:
kubeseal -f mysecret.json -w mysealedsecret.json

# At this point mysealedsecret.json is safe to upload to Github,
# post on Twitter, etc.

# Eventually:
kubectl create -f mysealedsecret.json

# Profit!
kubectl get secret mysecret

# Create a json/yaml-encoded Secret somehow:
# (note use of `--dry-run` - this is just a local file!)
echo -n supersecret | kubectl create secret generic mysecret --dry-run=client --from-file=password=/dev/stdin -o json >mysecret.json

# This is the important bit:
kubeseal -f mysecret.json -w mysealedsecret.json

# At this point mysealedsecret.json is safe to upload to Github,
# post on Twitter, etc.

# Eventually:
kubectl create -f mysealedsecret.json

# Profit!
kubectl get secret mysecret
sealed-secret.yaml
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: mysecret
namespace: mynamespace
spec:
encryptedData:
    password: AgB+...<snip>...==
template:
    metadata:
    name: mysecret
    namespace: mynamespace

Reference Sealed Secrets

sample-app.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: <NAME>
namespace: <NAMESPACE>
spec:
replicas: 1
selector:
    matchLabels:
    app: <NAME>
template:
    metadata:
    labels:
        app: <NAME>
    spec:
    containers:
        - name: <NAME>
        image: <IMAGE>
        env:
            - name: <ENV_VAR_NAME>
            valueFrom:
                secretKeyRef:
                name: <SEALED_SECRET_NAME>
                key: <SEALED_SECRET_KEY>
sample-app.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: myapp
namespace: mynamespace
spec:
replicas: 1
selector:
    matchLabels:
    app: myapp
template:
    metadata:
    labels:
        app: myapp
    spec:
    containers:
        - name: myapp
        image: myimage:latest
        env:
            - name: PASSWORD
            valueFrom:
                secretKeyRef:
                name: mysealedsecret
                key: password

Reference