bitnami/sealed-secrets

Health v2 · maintenance only

Adoption not part of the score

9256 stars · 771 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

A Kubernetes controller plus the kubeseal CLI that lets you encrypt Kubernetes Secrets into one-way encrypted SealedSecrets that are safe to commit to Git, even public repositories. Only the controller running in the target cluster can decrypt them, enabling GitOps workflows for secrets.

Use cases

• store kubernetes secrets safely in git
• encrypt secrets for gitops workflows
• commit secrets to a public repository without leaking them
• manage k8s secrets declaratively with helm or kustomize
• rotate or update encrypted secrets in a git repo
• decrypt secrets only inside a target cluster

When to choose

• you practice GitOps and want secrets version-controlled in git
• you need one-way encryption where only the cluster can decrypt
• you use Helm or Kustomize and want secrets as part of your manifests
• you want to avoid external secret managers for simple use cases

When to avoid

• you need multi-cluster or team-wide secret sharing with fine-grained access control
• you require dynamic secret generation or rotation from a vault
• you are not using Kubernetes
• you need to recover the original secret outside the target cluster

Facets

cli-tool · maturity active

secrets-management cryptography deployment infrastructure-as-code cli security cloud-computing infrastructure-as-code self-hosted go windows cloud self-hosted kubernetes gitops sealed-secrets kubeseal kubernetes-controller secret-encryption bitnami devops containers linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="bitnami/sealed-secrets")