DEV Community

Cover image for 🎯 Scenario #13 — Encrypt Secrets Using Sealed Secrets (Bitnami) in Kubernetes
Latchu@DevOps
Latchu@DevOps

Posted on

🎯 Scenario #13 — Encrypt Secrets Using Sealed Secrets (Bitnami) in Kubernetes

#kubernetes #cicd #devops #containers

This is a must-know skill for DevOps, GitOps, ArgoCD, Flux, and secure CI/CD workflows.

You will learn to:

✅ Install Sealed Secrets controller
✅ Create a Kubernetes Secret
✅ Encrypt it into a SealedSecret (safe to commit to Git)
✅ Apply the encrypted object
✅ Verify the controller decrypts it back into a real Secret

Sealed Secrets = Git-safe encrypted secrets.

⚠️ Requirements

This scenario requires:

  • Any Kubernetes cluster (GKE, EKS, AKS, Minikube)
  • Access to install CRDs (cluster-admin recommended)

✅ Step 1 — Install the Sealed Secrets Controller (on Cluster)

Install using Helm (recommended):

helm repo add sealed-secrets https://bitnami-labs.github.io/sealed-secrets helm install sealed-secrets-controller sealed-secrets/sealed-secrets \ --namespace kube-system
Enter fullscreen mode Exit fullscreen mode

Verify:

kubectl -n kube-system get pods | grep sealed-secrets
Enter fullscreen mode Exit fullscreen mode

You should see:

sealed-secrets-controller-xxxxx Running
Enter fullscreen mode Exit fullscreen mode

1

✅ Step 2 — Install kubeseal CLI (local machine / Cloud Shell)

For Cloud Shell or Linux:

curl -L -O https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.32.2/kubeseal-0.32.2-linux-amd64.tar.gz tar -xzvf kubeseal-0.32.2-linux-amd64.tar.gz kubeseal sudo install -m 755 kubeseal /usr/local/bin/kubeseal
Enter fullscreen mode Exit fullscreen mode

Verify:

kubeseal --version
Enter fullscreen mode Exit fullscreen mode

2

✅ Step 3 — Create a Secret (DO NOT APPLY)

Create a file:

#mysecret.yaml apiVersion: v1 kind: Secret metadata: name: db-credentials namespace: default type: Opaque data: username: YWRtaW4= password: U2VjdXJlMTIzIQ==
Enter fullscreen mode Exit fullscreen mode

This YAML contains sensitive base64 values → NEVER commit this.

Now we will encrypt it.

✅ Step 4 — Encrypt Secret into SealedSecret

Run:

kubeseal --controller-namespace kube-system --format yaml \ < mysecret.yaml > mysealedsecret.yaml
Enter fullscreen mode Exit fullscreen mode

Check output:

cat mysealedsecret.yaml
Enter fullscreen mode Exit fullscreen mode

You will see something like:

apiVersion: bitnami.com/v1alpha1 kind: SealedSecret metadata: name: db-credentials namespace: default spec: encryptedData: password: AgDY72jkLJ8z... username: AgJ80QKlhxn...
Enter fullscreen mode Exit fullscreen mode

✔ Safe to store in Git
✔ Only decryptable by the controller running in your cluster

!3](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mznguimzz4132dcpc76l.png)

✅ Step 5 — Apply the SealedSecret 

kubectl apply -f mysealedsecret.yaml
Enter fullscreen mode Exit fullscreen mode

The controller will automatically:

  • Decrypt the sealed data
  • Create the real Kubernetes Secret

Verify:

kubectl get secret db-credentials
Enter fullscreen mode Exit fullscreen mode

You will see:

db-credentials Opaque 2 5s
Enter fullscreen mode Exit fullscreen mode

4

✅ Step 6 — Check Decrypted Secret Values

Run:

kubectl get secret db-credentials -o jsonpath='{.data.username}' | base64 -d
Enter fullscreen mode Exit fullscreen mode

Output:

admin
Enter fullscreen mode Exit fullscreen mode

Check password:

kubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 -d
Enter fullscreen mode Exit fullscreen mode

Output:

Secure123!
Enter fullscreen mode Exit fullscreen mode

✔ Decrypted successfully
✔ Exactly what you defined
✔ But the secret in Git is encrypted

5

🌟 Thanks for reading! If this post added value, a like ❤️, follow, or share would encourage me to keep creating more content.

— Latchu | Senior DevOps & Cloud Engineer

☁️ AWS | GCP | ☸️ Kubernetes | 🔐 Security | ⚡ Automation
📌 Sharing hands-on guides, best practices & real-world cloud solutions

Top comments (0)