Bitnami sealed secrets have a simple, yet not straight-forward lifecycle due to multiple moving parts involved
Create
# Assuming sealed-secrets was created with the helm chart way described in the previous post ❯ kubectl create secret generic db-creds --from-literal=user=adam --from-literal=password=paSSwoRD --dry-run=client -o yaml | kubeseal --controller-namespace=sealed-secrets --controller-name=ss-app-sealed-secrets -o yaml | kubectl apply -f - sealedsecret.bitnami.com/db-creds created ❯ kubectl get sealedsecrets.bitnami.com NAME AGE db-creds 10s # also created is a kubernetes secret named "db-creds" ❯ kubectl get secrets NAME TYPE DATA AGE db-creds Opaque 2 17s default-token-j8wnt kubernetes.io/service-account-token 3 6h11m Rename
Under normal circumstances renaming a sealed-secret fails the decryption bacause is part of the encryption/decryption in the default strict mode
❯ kubectl create secret generic db-creds-alpha --from-literal=user=adam --from-literal=password=paSSwoRD --dry-run=client -o yaml | kubeseal --controller-namespace=sealed-secrets --controller-name=ss-app-sealed-secrets -o yaml | kubectl apply -f - sealedsecret.bitnami.com/db-creds-alpha created ❯ kubectl get sealedsecrets.bitnami.com NAME AGE db-creds-alpha 84s # try editing the name from "db-creds-alpha" to "db-creds-beta" ❯ kubectl edit sealedsecrets.bitnami.com/db-creds-alpha A copy of your changes has been stored to "/var/folders/1w/9brxn3wn27b3xgk2t7hj5ns40000gn/T/kubectl-edit-1525276124.yaml" error: At least one of apiVersion, kind and name was changed For the secret to be rename-able, one needs to scope it to namespace-wide or cluster-wide
❯ kubectl create secret generic db-creds-alpha --from-literal=user=adam --from-literal=password=paSSwoRD --dry-run=client -o yaml | kubeseal --controller-namespace=sealed-secrets --controller-name=ss-app-sealed-secrets --scope=namespace-wide -o yaml | kubectl apply -f - sealedsecret.bitnami.com/db-creds-alpha created # edit name from "db-creds-alpha" to "db-creds-beta" ❯ vi /tmp/ss.yaml # apply and verify ❯ k apply -f /tmp/ss.yaml sealedsecret.bitnami.com/db-creds-beta created # a new secret with the new name is created ❯ k get sealedsecrets.bitnami.com NAME AGE db-creds-alpha 3m4s db-creds-beta 7s Update
# assume sealed-secret is in sealed-secret.yaml ❯ echo -n adminDatabase | kubectl create secret generic mysecret --dry-run=client --from-file=db_name=/dev/stdin -o yaml | kubeseal --controller-namespace=sealed-secrets --controller-name=ss-app-sealed-secrets --merge-into sealed-secret.yaml ❯ kubectl apply -f sealed-secret.yaml sealedsecret.bitnami.com/db-creds configured ❯ k get secret db-creds -o json | jq ".data | map_values(@base64d)" { "db_name": "adminDatabase", "password": "paSSwoRD", "user": "adam" } Delete
❯ kubectl delete sealedsecrets.bitnami.com db-creds sealedsecret.bitnami.com "db-creds" deleted # Note: this also deletes the kubernetes secret named "db-creds" 
Top comments (0)