Seal with offline cert

Seal without cluster access using pre-fetched certificate

kubeseal --cert pub-cert.pem -o yaml < secret.yaml > sealed.yaml
tool
sealed-secrets11 commands
tags
secrets

More sealed-secrets commands

  • List SealedSecrets
    kubectl get sealedsecret -A

    Show all SealedSecrets and their sync status

  • Seal a secret from file
    kubeseal --format=yaml < secret.yaml > sealed-secret.yaml

    Encrypt a Kubernetes Secret YAML into a SealedSecret

  • Seal from stdin with scope
    kubectl create secret generic mysecret --dry-run=client --from-literal=token=abc123 -o yaml | kubeseal --scope cluster-wide -o yaml

    Create and seal a secret in cluster-wide scope

  • Fetch public certificate
    kubeseal --fetch-cert --controller-name=sealed-secrets --controller-namespace=kube-system > pub.pem

    Save the sealing certificate for offline encryption

  • Seal offline with cert
    kubeseal --cert pub.pem --format yaml < secret.yaml > sealed.yaml

    Encrypt without cluster access using saved cert

all 11 sealed-secrets commands