Demo Setup Bitnami Sealed

In this lesson we configure Bitnami Sealed Secrets with Flux so you can store encrypted secrets in Git and let Flux apply them to your cluster. This walkthrough assumes you are working in the bb-apps-source repository and want Flux to install the Bitnami Sealed Secrets Helm chart from the Bitnami Labs Helm repository. Key topics covered:

Registering the Bitnami Helm repository with Flux
Creating a Flux Kustomization to install Sealed Secrets
Verifying the Sealed Secrets controller
Installing the kubeseal CLI and obtaining the controller public certificate
Sealing secrets locally and committing sealed manifests to Git

Relevant links:

Flux: https://fluxcd.io/
Bitnami Sealed Secrets (GitHub): https://github.com/bitnami-labs/sealed-secrets
kubeseal releases: https://github.com/bitnami-labs/sealed-secrets/releases
Kubernetes docs: https://kubernetes.io/docs/

1. Checkout the infrastructure branch

Switch to the infrastructure branch in your bb-app-source repository:

# inside ~/bb-app-source
git checkout infrastructure
# Expected output:
# Switched to branch 'infrastructure'
# Your branch is up to date with 'origin/infrastructure'.

2. HelmRepository (Bitnami Sealed Secrets)

In your infrastructure Git repo, create a HelmRepository that points at the Bitnami Sealed Secrets Helm chart index. Example HelmRepository YAML:

apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: sealed-secrets
  namespace: flux-system
spec:
  interval: 24h
  url: https://bitnami-labs.github.io/sealed-secrets

Place this file under the path you use for infrastructure manifests (for example, create a bitnami-sealed-secrets folder inside the infrastructure branch and put the YAML there). Quick mapping of repository layout (example):

Purpose	Repository / Path	Notes
HelmRepository manifest	`infrastructure/bitnami-sealed-secrets/helmrepository.yaml`	Flux will pick this up from your infrastructure branch
Sealed Secret manifests	`infrastructure/bitnami-sealed-secrets/`	Add sealed-secret YAML here to be committed to Git and applied by Flux

3. Create a Flux Kustomization in the cluster repo

In the repository that holds your Flux cluster configuration (for example block-buster/flux-clusters/dev-cluster) create a Kustomization that tells Flux to pull the bitnami-sealed-secrets path from the infra-source-git GitRepository you previously configured. Example Kustomization YAML (exported from flux create kustomization):

apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
  name: infra-security-kustomize-git-sealed-secrets
  namespace: flux-system
spec:
  interval: 1h0m0s
  path: ./bitnami-sealed-secrets
  prune: true
  sourceRef:
    kind: GitRepository
    name: infra-source-git

Or generate the YAML from the CLI and export it:

cd ~/block-buster/flux-clusters/dev-cluster
flux create kustomization infra-security-kustomize-git-sealed-secrets \
  --source GitRepository/infra-source-git \
  --prune=true \
  --interval=1h \
  --path=./bitnami-sealed-secrets \
  --export > infra-security-kustomize-git-sealed-secrets.yml

This Kustomization instructs Flux to watch the infra-source-git repository and apply manifests under ./bitnami-sealed-secrets.

4. Reconcile Flux sources (optional manual reconcile)

After committing and pushing the Kustomization to your cluster repo, you can manually reconcile the Git source to accelerate propagation into the cluster:

# reconcile the GitRepository in namespace flux-system (replace infra-source-git with your GitRepository name)
flux reconcile source git infra-source-git -n flux-system
# then reconcile the kustomization if desired
flux reconcile kustomization infra-security-kustomize-git-sealed-secrets -n flux-system

After these commands, check Flux logs or the Kustomization status to confirm resources were fetched and applied.

5. Confirm the Sealed Secrets controller is installed

The Helm chart will install the Sealed Secrets controller, commonly into the kube-system namespace (depending on chart values). Verify the controller deployment, service and pods:

kubectl -n kube-system get all

Example relevant output (trimmed):

NAME                                      READY   STATUS    RESTARTS   AGE
pod/sealed-secrets-controller-7dff5cfc86-pk6pb   1/1     Running   0     18s

NAME                             TYPE        CLUSTER-IP       PORT(S)    AGE
service/sealed-secrets-controller ClusterIP   10.105.220.230   8080/TCP   18s

NAME                                     READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/sealed-secrets-controller 1/1    1            1           18s

NAME                                             DESIRED   CURRENT   READY   AGE
replicaset.apps/sealed-secrets-controller-7dff5cfc86 1     1         1       18s

The controller also creates a Kubernetes Secret containing its TLS private key and public certificate—these are used for sealing/unsealing operations.

6. Install kubeseal CLI locally

To create sealed secrets locally you need the kubeseal CLI. Download, extract and place it on your PATH. Example (Linux, using v0.19.5—use the latest stable release in production):

# Example: download kubeseal v0.19.5 (use the latest stable for production)
wget https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.19.5/kubeseal-0.19.5-linux-amd64.tar.gz

tar -xzf kubeseal-0.19.5-linux-amd64.tar.gz
# This will extract a kubeseal binary (and possibly other files)
sudo mv kubeseal /usr/local/bin/
sudo chmod +x /usr/local/bin/kubeseal

# Verify version
kubeseal --version
# Expected output:
# kubeseal version: 0.19.5

If you prefer a package manager, use Homebrew, apt, or your platform’s package manager to install kubeseal and avoid manual downloads.

7. Obtain the controller public certificate

To encrypt (seal) secrets you only need the Sealed Secrets controller’s public certificate. You can fetch it directly with kubeseal (recommended) or extract it from the controller Secret. Recommended approach — fetch the PEM certificate with kubeseal:

kubeseal \
  --fetch-cert \
  --controller-name sealed-secrets-controller \
  --controller-namespace kube-system \
  > sealed-secret.pub

This writes the controller’s public certificate (PEM format) to sealed-secret.pub. Keep this file; use it locally to create sealed secrets for this cluster. Alternative: extract the certificate from the controller secret manually:

# List secrets and identify the one created by sealed-secrets
kubectl -n kube-system get secret

# View the secret (replace ` <secret-name> ` with the actual secret)
kubectl -n kube-system get secret <secret-name> -o yaml

# Decode the certificate (example)
kubectl -n kube-system get secret <secret-name> -o jsonpath='{.data.tls\.crt}' | base64 --decode > sealed-secret.pub

Important: Do not expose the controller private key (tls.key). Only the public certificate (tls.crt) is required for sealing secrets. The private key must remain secret to prevent unsealing compromise.

8. What’s next

With the public certificate downloaded (sealed-secret.pub) and kubeseal installed you can:

Create plaintext Kubernetes Secret manifests (or use kubectl create secret to make them).
Use kubeseal --cert sealed-secret.pub to convert those secrets into SealedSecret manifests.
Commit the sealed-secret YAML files to your infrastructure Git repo under the bitnami-sealed-secrets path so Flux will apply them to the cluster.

Example high-level commands (seal a secret.yaml into sealed-secret.yaml):

kubectl create secret generic my-secret --from-literal=username=admin --from-literal=password=s3cr3t --dry-run=client -o yaml > secret.yaml

kubeseal --cert sealed-secret.pub -o yaml < secret.yaml > sealed-secret.yaml

# Commit sealed-secret.yaml to your infra Git repository and push
git add sealed-secret.yaml
git commit -m "Add sealed secret for my app"
git push

Once pushed, Flux will pick up the sealed secret and apply it — the Sealed Secrets controller will decrypt it into a regular Kubernetes Secret inside the cluster. That’s all for this lesson. Follow the links above for more details on Flux and Bitnami Sealed Secrets, and adopt a secure workflow for managing sealed secrets in Git.

GitOps Overview

Flux Overview

Source and Kustomize Controller

Helm Controller and OCI Registry

Image Automation Controller

Secret Management & Sign Verification

Notification Controller

Monitoring & User Interface

Demo Setup Bitnami Sealed

1. Checkout the infrastructure branch

2. HelmRepository (Bitnami Sealed Secrets)

3. Create a Flux Kustomization in the cluster repo

4. Reconcile Flux sources (optional manual reconcile)

5. Confirm the Sealed Secrets controller is installed

6. Install kubeseal CLI locally

7. Obtain the controller public certificate

8. What’s next

Watch Video

​1. Checkout the infrastructure branch

​2. HelmRepository (Bitnami Sealed Secrets)

​3. Create a Flux Kustomization in the cluster repo

​4. Reconcile Flux sources (optional manual reconcile)

​5. Confirm the Sealed Secrets controller is installed

​6. Install kubeseal CLI locally

​7. Obtain the controller public certificate

​8. What’s next

Watch Video

1. Checkout the infrastructure branch

2. HelmRepository (Bitnami Sealed Secrets)

3. Create a Flux Kustomization in the cluster repo

4. Reconcile Flux sources (optional manual reconcile)

5. Confirm the Sealed Secrets controller is installed

6. Install kubeseal CLI locally

7. Obtain the controller public certificate

8. What’s next