Sealed Secrets ¶
The sealed-secrets controller will automatically generate a public+private keypair for each cluster that will be used to encrypt and decrypt secrets.
After any new cluster is provisioned, the generated keypair should be backed up externally (i.e. to a shared VaultWarden/BitWarden collection). With the keypair backed up, secrets can be decrypted locally or restored to a new cluster in the future.
Back up generated keys ¶
From the sealed-secrets README.md:
kubectl get secret \
-n sealed-secrets \
-l sealedsecrets.bitnami.com/sealed-secrets-key \
-o yaml \
> cluster-sealed-secrets-master.key
Sensitive data!
Be sure to keep this file secure and delete from your working directory after uploading it to a secure credentials vault for backup.
Do not commit this file to source control
Enable ingress ¶
The sealed-secrets helm chart includes an ingress that can be configured to provide a public URL to the cluster’s public certificate that can be used for local kubeseal client operations.
To enable the ingress, configure and deploy sealed-secrets/release-values.yaml:
ingress:
enabled: true
annotations:
kubernetes.io/ingress.class: nginx
cert-manager.io/cluster-issuer: letsencrypt-prod
hosts:
- sealed-secrets.mycluster.k8s.example.net
tls:
- secretName: sealed-secrets-tls
hosts:
- sealed-secrets.mycluster.k8s.example.net
Once deployed, local kubeseal clients can be configured to use it by setting the SEALED_SECRETS_CERT environment variable:
export SEALED_SECRETS_CERT=https://sealed-secrets.mycluster.k8s.example.net/v1/cert.pem