Check sealed-secrets controller logs

Stream controller logs to debug sealing issues

kubectl logs -n kube-system -l app.kubernetes.io/name=sealed-secrets -f

More sealed-secrets commands

List all SealedSecrets

kubectl get sealedsecrets -A

Show all SealedSecrets across namespaces
Re-seal with new key

kubectl get secret mysecret -o yaml | kubeseal --format yaml > sealed-new.yaml

Fetch decrypted secret and re-encrypt with current key
Seal a secret

kubectl create secret generic mysecret --dry-run=client -n <ns> --from-literal=key=value -o yaml | kubeseal -o yaml > sealed.yaml

Create and seal a k8s secret in one pipeline
Fetch public cert

kubeseal --fetch-cert --controller-name=sealed-secrets > pub-cert.pem

Download the sealing certificate for offline operations
Seal with offline cert

kubeseal --cert pub-cert.pem -o yaml < secret.yaml > sealed.yaml

Seal without cluster access using pre-fetched certificate