Sealed Secrets

v0.38.2 (2026-07-03T09:39:04Z)

New v0.38.2 release!

Changelog

• ab52b3821629897708fc401297602937b475165b Add Artifact Hub badge to README (#1999)
• 2623137107709c61bbd63196d9d4d4d5dafd72c1 Bump github.com/onsi/ginkgo/v2 from 2.30.0 to 2.32.0 (#1998)
• c2dc70579b5ca1792c25d1a9a064e0542d75110d Bump github.com/onsi/gomega from 1.41.0 to 1.42.0 (#1995)
• 183e91c2fb218071bc7f752fe8aef38fef83d540 Bump github.com/onsi/gomega from 1.42.0 to 1.42.1 (#1997)
• 792723c21f351a95f764003f5f929f5979721328 Bump k8s.io/api from 0.36.1 to 0.36.2 (#1994)
• 5e4abed99401d2beb6adbc9aa4f7c00c1d542ffc Bump k8s.io/client-go from 0.36.1 to 0.36.2 (#1996)
• e256932a407edbf5d0d57664d9c6dc235db1f43e Bump k8s.io/code-generator from 0.36.1 to 0.36.2 (#1993)
• 33b890d5f87d43721e4454e9d3b12d369537f2b0 Publish Artifact Hub repository metadata for verified publisher status (#2000)
• 20c250b253b101922ad1b6519e5730800b49305d Release carvel package 2.19.0 (#1991)
• e88bf0ace0b5249d08623ea5cd203943549de7f3 Release notes 0.38.2 (#2001)

Installation Instructions

Cluster-side

Install the SealedSecret CRD and server-side controller into the kube-system namespace:

kubectl apply -f https://github.com/bitnami/sealed-secrets/releases/download/v0.38.2/controller.yaml

Client-side

Install the client-side tool into /usr/local/bin/:

Linux x86_64:

curl -OL "https://github.com/bitnami/sealed-secrets/releases/download/v0.38.2/kubeseal-0.38.2-linux-amd64.tar.gz"
tar -xvzf kubeseal-0.38.2-linux-amd64.tar.gz kubeseal
sudo install -m 755 kubeseal /usr/local/bin/kubeseal

macOS:
The kubeseal client is available on homebrew:

brew install kubeseal

MacPorts:

The kubeseal client is available on MacPorts:

port install kubeseal

Nixpkgs

The kubeseal client is available on Nixpkgs: (DISCLAIMER: Not maintained by bitnami)

nix-env -iA nixpkgs.kubeseal

Other OS/Arch:
Binaries for other OS/arch combinations are attached to this release below.

If you just want the latest client tool, it can be installed into
$GOPATH/bin with:

go install github.com/bitnami/sealed-secrets/cmd/kubeseal@main

You can specify a release tag or a commit SHA instead of main.

The go install command will place the kubeseal binary at $GOPATH/bin:

$(go env GOPATH)/bin/kubeseal

Release Notes

Please read the RELEASE_NOTES which contain among other things important information for those upgrading from previous releases.

Thanks!