Sealed Secrets

v0.38.0 (2026-06-18T12:28:41Z)

New v0.38.0 release!

Changelog

• 8ba4b5b27f98369b37619dda3d37533771aaea35 Adding default prometheusRule in helmChart to watch out of sync secrets (#1980)
• 9a5984ca4d169375cafcadfde59cea618145d62c Bump Golang to 1.26.4 (#1987)
• 85834b44a94a3ff0dc573915f7e560c1473a4dff Bump github.com/onsi/ginkgo/v2 from 2.28.3 to 2.29.0 (#1976)
• fddaab340509b78e9279e4c0cd65584f5a3956b1 Bump github.com/onsi/ginkgo/v2 from 2.29.0 to 2.30.0 (#1985)
• 8bba3384a2b89f7699af0b04f6ee51ed2d244dfd Bump github.com/onsi/gomega from 1.40.0 to 1.41.0 (#1975)
• ae2c71dd973f8db4ed931e7997dabc1550b6a8e7 Bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#1977)
• b7f26263b03619c18aa494fa3d95015ea796059e Bump golang.org/x/crypto from 0.52.0 to 0.53.0 (#1984)
• fa71a753b869d433c39e247a217d1f37a9711137 Change oci registry for publishing the chart (#1970)
• 5d360fd400f0d93ac42d123eb81336a2d64d1772 Migrate all bitnami-labs references to bitnami org (#1983)
• dc9f8fc1eb52c7a7a0e64a6dbae6084c91db5a10 Release notes v0.38.0 (#1988)
• 8a9e8328a4798ba4ccfec6120267539f07e38fb8 Revert "Fix oci push" (#1979)
• 4e61da07fcf6ff342e38effdabbe2209ea165214 Update security context defaults to comply with restricted pod securi… (#1981)
• 9d63881cda6d8a7175fe34a62c881039cdde9db2 feat: add ppc64le architecture support (#1973)
• 5ba86c2314552b678e4ff144b76073f3e35d9ffd fix: add mutex locking to KeyRegistry to prevent data races (#1905)

Installation Instructions

Cluster-side

Install the SealedSecret CRD and server-side controller into the kube-system namespace:

kubectl apply -f https://github.com/bitnami/sealed-secrets/releases/download/v0.38.0/controller.yaml

Client-side

Install the client-side tool into /usr/local/bin/:

Linux x86_64:

curl -OL "https://github.com/bitnami/sealed-secrets/releases/download/v0.38.0/kubeseal-0.38.0-linux-amd64.tar.gz"
tar -xvzf kubeseal-0.38.0-linux-amd64.tar.gz kubeseal
sudo install -m 755 kubeseal /usr/local/bin/kubeseal

macOS:
The kubeseal client is available on homebrew:

brew install kubeseal

MacPorts:

The kubeseal client is available on MacPorts:

port install kubeseal

Nixpkgs

The kubeseal client is available on Nixpkgs: (DISCLAIMER: Not maintained by bitnami)

nix-env -iA nixpkgs.kubeseal

Other OS/Arch:
Binaries for other OS/arch combinations are attached to this release below.

If you just want the latest client tool, it can be installed into
$GOPATH/bin with:

go install github.com/bitnami/sealed-secrets/cmd/kubeseal@main

You can specify a release tag or a commit SHA instead of main.

The go install command will place the kubeseal binary at $GOPATH/bin:

$(go env GOPATH)/bin/kubeseal

Release Notes

Please read the RELEASE_NOTES which contain among other things important information for those upgrading from previous releases.

Thanks!