Bitnami Sealed Secrets

​

1. Declarative Secret Storage

​

Creating a Standard Secret

kubectl create secret generic mysql-password \
  --from-literal=password=s1Dhd@rt# \
  --dry-run=client -o yaml > mysql_k8s-secret.yaml

apiVersion: v1
kind: Secret
metadata:
  name: mysql-password
data:
  password: czFEZhAcnQj

​

2. Secret Management Solutions

​

3. What Are Bitnami Sealed Secrets?

• A Kubernetes controller that decrypts sealed secrets inside the cluster.
• A kubeseal CLI to encrypt Kubernetes Secret manifests to SealedSecret manifests.
• A safe-to-commit SealedSecret format (even on public repos) that only your controller can decrypt.

​

4. Installing the Sealed Secrets Controller with Flux

# 1. Add the Bitnami Sealed-Secrets Helm repository
flux create source helm sealed-secrets \
  --interval 1h \
  --url https://bitnami-labs.github.io/sealed-secrets

# 2. Create a HelmRelease for the controller
flux create helmrelease sealed-secrets-controller \
  --interval 1h \
  --release-name sealed-secrets-controller \
  --target-namespace kube-system \
  --source HelmRepository/sealed-secrets \
  --chart sealed-secrets \
  --chart-version ">=1.15.0-0" \
  --crds CreateReplace

​

5. Encrypting a Secret with kubeseal

1. Generate the plain Secret manifest (if not already done):
   kubectl create secret generic mysql-password \
     --from-literal=password=s1Ddh@rt* \
     --dry-run=client -o yaml > mysql_k8s-secret.yaml
   
2. Install the kubeseal client:
   wget https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.18.0/kubeseal-0.18.0-linux-amd64.tar.gz
   tar -zxvf kubeseal-0.18.0-linux-amd64.tar.gz
   mv kubeseal /usr/local/bin/
   
3. Fetch the public certificate from the controller:
   kubeseal \
     --fetch-cert \
     --controller-name sealed-secrets-controller \
     --controller-namespace kube-system \
     > sealed-secrets.crt
   
4. Seal the Secret:
   kubeseal \
     --cert sealed-secrets.crt \
     --scope cluster-wide \
     -o yaml < mysql_k8s-secret.yaml \
     > mysql-password_sealedsecret.yaml
   

​

6. Example Manifests

​

6.1 Original Kubernetes Secret

apiVersion: v1
kind: Secret
metadata:
  name: mysql-password
type: Opaque
data:
  password: czFEZhAcnQj

​

6.2 Resulting SealedSecret

apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: mysql-password
  annotations:
    sealedsecrets.bitnami.com/cluster-wide: "true"
spec:
  encryptedData:
    password: AgBgdDPGdf3ngr7k3tA/Cg0B2UQd1wT390cVDs=
  template:
    metadata:
      name: mysql-password
      annotations:
        sealedsecrets.bitnami.com/cluster-wide: "true"
    data: {}

​

7. Applying the SealedSecret with Flux

1. Commit mysql-password_sealedsecret.yaml to your Git repo.
2. Flux syncs and applies the SealedSecret resource.
3. The Sealed Secrets controller in the cluster decrypts it and creates a standard Kubernetes Secret.
4. Your workloads can reference the decrypted Secret just like any other.

​

8. Summary

• Encrypted Secret manifests stored safely in Git.
• Automated HelmRelease deployment of the Sealed Secrets controller.
• CLI-driven encryption (kubeseal) and in-cluster decryption.
• A fully GitOps-friendly secret management workflow for Kubernetes.

​

Links and References

• Bitnami Sealed Secrets GitHub
• Flux CD Documentation
• Kubernetes Secrets
• GitOps Principles