Sealed Secrets

Bitnami Sealed Secrets lets you store encrypted secrets safely in Git. This chart supports Sealed Secrets natively; no extra configuration is needed beyond installing the controller in the cluster.

sealedSecrets and mountedSealedSecretFiles can also be set on a single deployment, job or cronJob, see Per-workload config.

Environment variables

Use sealedSecrets to declare encrypted values that are auto-mounted as environment variables in every container (same as secrets):

sealedSecrets:
  DATABASE_PASSWORD: AgBy3i4OJSWK...  # kubeseal --raw output
  API_KEY: AgCAt8kDe2nJ...

Seal a value with:

echo -n 'mysecret' | kubeseal --raw --from-file=/dev/stdin --scope namespace-wide --namespace mynamespace

Mounted files

Use mountedSealedSecretFiles to mount encrypted files into containers (same as mountedSecretFiles, defaults to /secrets/):

mountedSealedSecretFiles:
  serviceaccount.json: AgBy3i4OJSWK...  # mounted at /secrets/serviceaccount.json
  /etc/app/config.json: AgCAt8kDe2nJ... # mounted at absolute path

Scope

sealedSecretsScope must match the --scope the values were sealed with. It defaults to namespace-wide and applies to both sealedSecrets and mountedSealedSecretFiles, so every value in a release is sealed with the same scope:

sealedSecretsScope	Seal with	Unseals in
namespace-wide (default)	kubeseal --raw --scope namespace-wide --namespace <namespace>	that namespace, under any name
strict	kubeseal --raw --scope strict --namespace <namespace> --name <release>-sealed-secrets (or -sealed-secret-files)	that namespace, under that name only
cluster-wide	kubeseal --raw --scope cluster-wide	any namespace, under any name

A cluster-wide value can be unsealed by anyone who can create a SealedSecret in any namespace, so use it only when one sealed value has to be deployed to several namespaces. A strict value decrypts only under the SealedSecret name it was sealed for. Pre-hook and post-delete jobs read a shared hook copy of the release's sealedSecrets and mountedSealedSecretFiles under another name, so the chart refuses to render strict together with such a job. A deployment's, job's or cronJob's own sealed values render as <fullname>-<kind>-<name>-sealed-secrets (or -sealed-secret-files); seal strict values for that name.

Changing the scope

A value's scope is fixed when it is sealed, so changing sealedSecretsScope means resealing every value in the release:

1. Get the plain values. If no other copy exists, read them base64-encoded from the unsealed Secret with kubectl get secret <release>-sealed-secrets --output yaml.
2. Seal each value again with the kubeseal command for the new scope from the table above.
3. Replace the values in sealedSecrets and mountedSealedSecretFiles.
4. Set sealedSecretsScope to the new scope in the same values file.
5. Deploy the release, then check the SealedSecret status with kubectl get sealedsecret <release>-sealed-secrets --output jsonpath='{.status}'.

To keep values sealed with an older chart version working without resealing, set sealedSecretsScope: cluster-wide: older chart versions annotated every SealedSecret as cluster-wide.