Sealed Secrets
GitOpsA Kubernetes controller and CLI that lets you store encrypted secrets safely in git by sealing them into SealedSecret resources which only the cluster-side controller can decrypt.
Features
- Encrypts Kubernetes Secrets into SealedSecret CRDs for safe storage in version control
- Controller running in the target cluster is the sole entity able to decrypt sealed secrets
- Supports multiple installation methods: Helm, Kustomize, Homebrew, MacPorts, Nixpkgs, Linux binary and source builds
- Provides `kubeseal` CLI for sealing secrets locally before applying them
Recent releases
View all 14 releases →
v0.36.4
Maintenance
Updated Kubernetes integration test matrix to latest 1.33, 1.34, and 1.35 patch versions for compatibility verification.
v0.36.2
Security relevant
⚠ Upgrade required
- Release notes reference RELEASE-NOTES.md for important upgrade information from previous releases
Security fixes
- Bumped golang.org/x/crypto from 0.48.0 to 0.49.0 (cryptographic library update with potential security implications)
v0.36.1
Bug fix
Fixed OCI push action, explicitly specified TCP protocol for Helm Server-Side Apply compatibility, improved multi-namespace support, and removed helm deprecation notices.
v0.36.0
Security relevant
Security fixes
- Preserve scope during Sealed Secret rotation
- Throw error for inconsistencies in Sealed Secrets
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Install & Platforms
Install via
helm
macports
shell-script
Platforms
linux
macos
