sealed-secrets

Seal a secret Create and seal a k8s secret in one pipeline kubectl create secret generic mysecret --dry-run=client -n <ns> --from-literal=key=value -o yaml | kubeseal -o yaml > sealed.yaml #secrets#config Fetch public cert Download the sealing certificate for offline operations kubeseal --fetch-cert --controller-name=sealed-secrets > pub-cert.pem #secrets Seal with offline cert Seal without cluster access using pre-fetched certificate kubeseal --cert pub-cert.pem -o yaml < secret.yaml > sealed.yaml #secrets List SealedSecrets Show all SealedSecrets and their sync status kubectl get sealedsecret -A #secrets Seal a secret from file Encrypt a Kubernetes Secret YAML into a SealedSecret kubeseal --format=yaml < secret.yaml > sealed-secret.yaml #sealed-secrets#security Seal from stdin with scope Create and seal a secret in cluster-wide scope kubectl create secret generic mysecret --dry-run=client --from-literal=token=abc123 -o yaml | kubeseal --scope cluster-wide -o yaml #sealed-secrets#security Fetch public certificate Save the sealing certificate for offline encryption kubeseal --fetch-cert --controller-name=sealed-secrets --controller-namespace=kube-system > pub.pem #sealed-secrets#security Seal offline with cert Encrypt without cluster access using saved cert kubeseal --cert pub.pem --format yaml < secret.yaml > sealed.yaml #sealed-secrets#security Check sealed-secrets controller logs Stream controller logs to debug sealing issues kubectl logs -n kube-system -l app.kubernetes.io/name=sealed-secrets -f #sealed-secrets#debug List all SealedSecrets Show all SealedSecrets across namespaces kubectl get sealedsecrets -A #sealed-secrets Re-seal with new key Fetch decrypted secret and re-encrypt with current key kubectl get secret mysecret -o yaml | kubeseal --format yaml > sealed-new.yaml #sealed-secrets#security