> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo Setup Bitnami Sealed

> Guide to configuring Bitnami Sealed Secrets with Flux to store encrypted Kubernetes secrets in Git, seal them locally with kubeseal, and have Flux apply them to the cluster.

In this lesson we configure Bitnami Sealed Secrets with Flux so you can store encrypted secrets in Git and let Flux apply them to your cluster. This walkthrough assumes you are working in the `bb-apps-source` repository and want Flux to install the Bitnami Sealed Secrets Helm chart from the Bitnami Labs Helm repository.

Key topics covered:

* Registering the Bitnami Helm repository with Flux
* Creating a Flux Kustomization to install Sealed Secrets
* Verifying the Sealed Secrets controller
* Installing the `kubeseal` CLI and obtaining the controller public certificate
* Sealing secrets locally and committing sealed manifests to Git

Relevant links:

* Flux: [https://fluxcd.io/](https://fluxcd.io/)
* Bitnami Sealed Secrets (GitHub): [https://github.com/bitnami-labs/sealed-secrets](https://github.com/bitnami-labs/sealed-secrets)
* kubeseal releases: [https://github.com/bitnami-labs/sealed-secrets/releases](https://github.com/bitnami-labs/sealed-secrets/releases)
* Kubernetes docs: [https://kubernetes.io/docs/](https://kubernetes.io/docs/)

## 1. Checkout the infrastructure branch

Switch to the `infrastructure` branch in your `bb-app-source` repository:

```bash theme={null}
# inside ~/bb-app-source
git checkout infrastructure
# Expected output:
# Switched to branch 'infrastructure'
# Your branch is up to date with 'origin/infrastructure'.
```

## 2. HelmRepository (Bitnami Sealed Secrets)

In your infrastructure Git repo, create a `HelmRepository` that points at the Bitnami Sealed Secrets Helm chart index. Example `HelmRepository` YAML:

```yaml theme={null}
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: sealed-secrets
  namespace: flux-system
spec:
  interval: 24h
  url: https://bitnami-labs.github.io/sealed-secrets
```

Place this file under the path you use for infrastructure manifests (for example, create a `bitnami-sealed-secrets` folder inside the `infrastructure` branch and put the YAML there).

Quick mapping of repository layout (example):

| Purpose | Repository / Path | Notes |
| - | - | - |
| HelmRepository manifest | `infrastructure/bitnami-sealed-secrets/helmrepository.yaml` | Flux will pick this up from your infrastructure branch |
| Sealed Secret manifests | `infrastructure/bitnami-sealed-secrets/` | Add sealed-secret YAML here to be committed to Git and applied by Flux |

## 3. Create a Flux Kustomization in the cluster repo

In the repository that holds your Flux cluster configuration (for example `block-buster/flux-clusters/dev-cluster`) create a `Kustomization` that tells Flux to pull the `bitnami-sealed-secrets` path from the `infra-source-git` `GitRepository` you previously configured.

Example Kustomization YAML (exported from `flux create kustomization`):

```yaml theme={null}
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
  name: infra-security-kustomize-git-sealed-secrets
  namespace: flux-system
spec:
  interval: 1h0m0s
  path: ./bitnami-sealed-secrets
  prune: true
  sourceRef:
    kind: GitRepository
    name: infra-source-git
```

Or generate the YAML from the CLI and export it:

```bash theme={null}
cd ~/block-buster/flux-clusters/dev-cluster
flux create kustomization infra-security-kustomize-git-sealed-secrets \
  --source GitRepository/infra-source-git \
  --prune=true \
  --interval=1h \
  --path=./bitnami-sealed-secrets \
  --export > infra-security-kustomize-git-sealed-secrets.yml
```

This Kustomization instructs Flux to watch the `infra-source-git` repository and apply manifests under `./bitnami-sealed-secrets`.

## 4. Reconcile Flux sources (optional manual reconcile)

After committing and pushing the Kustomization to your cluster repo, you can manually reconcile the Git source to accelerate propagation into the cluster:

```bash theme={null}
# reconcile the GitRepository in namespace flux-system (replace infra-source-git with your GitRepository name)
flux reconcile source git infra-source-git -n flux-system
# then reconcile the kustomization if desired
flux reconcile kustomization infra-security-kustomize-git-sealed-secrets -n flux-system
```

After these commands, check Flux logs or the Kustomization status to confirm resources were fetched and applied.

## 5. Confirm the Sealed Secrets controller is installed

The Helm chart will install the Sealed Secrets controller, commonly into the `kube-system` namespace (depending on chart values). Verify the controller deployment, service and pods:

```bash theme={null}
kubectl -n kube-system get all
```

Example relevant output (trimmed):

```text theme={null}
NAME                                      READY   STATUS    RESTARTS   AGE
pod/sealed-secrets-controller-7dff5cfc86-pk6pb   1/1     Running   0     18s

NAME                             TYPE        CLUSTER-IP       PORT(S)    AGE
service/sealed-secrets-controller ClusterIP   10.105.220.230   8080/TCP   18s

NAME                                     READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/sealed-secrets-controller 1/1    1            1           18s

NAME                                             DESIRED   CURRENT   READY   AGE
replicaset.apps/sealed-secrets-controller-7dff5cfc86 1     1         1       18s
```

The controller also creates a Kubernetes `Secret` containing its TLS private key and public certificate—these are used for sealing/unsealing operations.

## 6. Install kubeseal CLI locally

To create sealed secrets locally you need the `kubeseal` CLI. Download, extract and place it on your PATH. Example (Linux, using v0.19.5—use the latest stable release in production):

```bash theme={null}
# Example: download kubeseal v0.19.5 (use the latest stable for production)
wget https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.19.5/kubeseal-0.19.5-linux-amd64.tar.gz

tar -xzf kubeseal-0.19.5-linux-amd64.tar.gz
# This will extract a kubeseal binary (and possibly other files)
sudo mv kubeseal /usr/local/bin/
sudo chmod +x /usr/local/bin/kubeseal

# Verify version
kubeseal --version
# Expected output:
# kubeseal version: 0.19.5
```

If you prefer a package manager, use Homebrew, apt, or your platform's package manager to install `kubeseal` and avoid manual downloads.

## 7. Obtain the controller public certificate

To encrypt (seal) secrets you only need the Sealed Secrets controller's public certificate. You can fetch it directly with `kubeseal` (recommended) or extract it from the controller `Secret`.

Recommended approach — fetch the PEM certificate with kubeseal:

```bash theme={null}
kubeseal \
  --fetch-cert \
  --controller-name sealed-secrets-controller \
  --controller-namespace kube-system \
  > sealed-secret.pub
```

This writes the controller's public certificate (PEM format) to `sealed-secret.pub`. Keep this file; use it locally to create sealed secrets for this cluster.

Alternative: extract the certificate from the controller secret manually:

```bash theme={null}
# List secrets and identify the one created by sealed-secrets
kubectl -n kube-system get secret

# View the secret (replace ` <secret-name> ` with the actual secret)
kubectl -n kube-system get secret <secret-name> -o yaml

# Decode the certificate (example)
kubectl -n kube-system get secret <secret-name> -o jsonpath='{.data.tls\.crt}' | base64 --decode > sealed-secret.pub
```

Important: Do not expose the controller private key (`tls.key`). Only the public certificate (`tls.crt`) is required for sealing secrets. The private key must remain secret to prevent unsealing compromise.

## 8. What’s next

With the public certificate downloaded (`sealed-secret.pub`) and `kubeseal` installed you can:

1. Create plaintext Kubernetes Secret manifests (or use `kubectl create secret` to make them).
2. Use `kubeseal --cert sealed-secret.pub` to convert those secrets into SealedSecret manifests.
3. Commit the sealed-secret YAML files to your infrastructure Git repo under the `bitnami-sealed-secrets` path so Flux will apply them to the cluster.

Example high-level commands (seal a `secret.yaml` into `sealed-secret.yaml`):

```bash theme={null}
kubectl create secret generic my-secret --from-literal=username=admin --from-literal=password=s3cr3t --dry-run=client -o yaml > secret.yaml

kubeseal --cert sealed-secret.pub -o yaml < secret.yaml > sealed-secret.yaml

# Commit sealed-secret.yaml to your infra Git repository and push
git add sealed-secret.yaml
git commit -m "Add sealed secret for my app"
git push
```

Once pushed, Flux will pick up the sealed secret and apply it — the Sealed Secrets controller will decrypt it into a regular Kubernetes Secret inside the cluster.

That’s all for this lesson. Follow the links above for more details on Flux and Bitnami Sealed Secrets, and adopt a secure workflow for managing sealed secrets in Git.

> **[Watch Video](https://learn.kodekloud.com/user/courses/gitops-with-fluxcd/module/c8ad2608-2804-4413-9041-5e8dc9126d53/lesson/254cf972-bcf8-421d-81ec-9434f6d441fc)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.