> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Why do we need Sealed Secrets

> This article explains the importance of Sealed Secrets in Kubernetes for securely managing sensitive information in GitOps workflows.

Before exploring how Sealed Secrets work, let’s examine the gap they fill in a GitOps-based Kubernetes workflow.

## The risk of plain Kubernetes Secrets in Git

In a GitOps pipeline, you typically declare your resources—including Secrets—as YAML manifests and commit them to your repository. Kubernetes offers two methods to create a Secret:

* **Imperative**:
  ```bash theme={null}
  kubectl create secret generic database --from-literal=DB_PASSWORD=password123
  ```
* **Declarative** (preferred in GitOps):
  ```yaml theme={null}
  apiVersion: v1
  kind: Secret
  metadata:
    name: database
    namespace: default
  data:
    DB_PASSWORD: cGFzc3dvcmQxMjM=
  ```

When you apply the declarative manifest, Kubernetes Base64-encodes your password (`password123` → `cGFzc3dvcmQxMjM=`).

<Callout icon="lightbulb" color="#1CB2FE">
  Base64 encoding is **not** encryption. Anyone with read access to your cluster or Git repo can decode the value back to cleartext.
</Callout>

```bash theme={null}
echo cGFzc3dvcmQxMjM= | base64 --decode
# output: password123
```

If these YAML files land in a public or team-wide repository, **anyone** with read permissions can retrieve your database credentials in seconds.

## How Sealed Secrets protect your credentials

Sealed Secrets let you store **encrypted** secrets safely in Git. You generate a SealedSecret that only your Kubernetes cluster can decrypt:

1. Install the Sealed Secrets controller in your cluster.
2. Seal your plain-Secret using the controller’s `kubeseal` CLI.
3. Commit the resulting `SealedSecret` resource to Git.

At runtime, the controller automatically decrypts the sealed payload and creates a native `Secret` inside the cluster—no one else can reverse-engineer it from your repo.

## Key benefits

| Feature                  | Benefit                                          |
| ------------------------ | ------------------------------------------------ |
| End-to-end encryption    | Secrets remain encrypted at rest in Git          |
| GitOps-friendly workflow | Manage sealed resources alongside your manifests |
| Cluster-bound decryption | Only your cluster’s controller can unseal them   |

## References

* [Sealed Secrets GitHub](https://github.com/bitnami-labs/sealed-secrets)
* [Kubernetes Secrets](https://kubernetes.io/docs/concepts/configuration/secret/)
* [GitOps with Sealed Secrets](https://github.com/bitnami-labs/sealed-secrets#usage)

<CardGroup>
  <Card title="Watch Video" icon="video" cta="Learn more" href="https://learn.kodekloud.com/user/courses/introduction-to-sealed-secrets-in-kubernetes/module/0f3ed562-f151-48f9-bb8c-8d3a4dbb4fc3/lesson/53d78662-3e7a-4fe7-9145-84a6bc0d90b8" />
</CardGroup>