Kubeseal

Kubeseal is a Kubernetes controller and tool for one-way encrypted Secrets.

Getting Started

Installation

Client side

Use kubeseal.sh script.

Cluster side

Install SealedSecret CRD, server-side controller into kube-system namespace.

$ kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/$KUBESEAL_VERSION/controller.yaml

NOTE: If you can't (or don't want) to use the kube-system namespace, please consider this approach

NOTE: if you want to install it on a GKE cluster for which your user account doesn't have admin rights, please read this

NOTE: since the helm chart is currently maintained elsewhere (see https://github.com/helm/charts/tree/master/stable/sealed-secrets the update of the helm chart might not happen in sync with releases here.

Sealed Secrets

• create working directory

  mkdir -p sealed-secrets
  cd sealed-secrets
  

• create base directory

  mkdir -p base
  

• create base/kustomization.yaml file

  vi base/kustomization.yaml
  

• test kustomize

  kustomize build base
  

• download sealed-secrets controller

  export URL=https://github.com/bitnami-labs/sealed-secrets/releases/
  export URL=${URL}/download/v0.14.1/controller.yaml
  wget ${URL} -O base/controller.yaml
  

• check base/controller.yaml file

  vi base/controller.yaml
  kustomize build base
  

• update base/kustomization.yaml file

  vi base/kustomization.yaml
  kustomize build base
  

• apply kustomize output

  kustomize build base | kubectl apply --filename -
  

• get pods

  kubectl get all -n sealed secrets
  kubectl get all -n sealed-secrets
  kubectl get pod -n sealed secrets
  

• get ingress

  kubectl get ingresses -A
  kubectl -n sealed-secrets get ingresses
  kubectl --namespace argo get ingresses
  kubectl --namespace sealed-secrets get ingresses
  

• get namespaces

  kubectl get namespaces
  

• create test-secrets namespace

  kubectl create namespace test-secrets
  

• try to simulate create secret

  kubectl --namespace test-secrets create secret generic mysecret \
  --dry-run=client --from-literal foo=bar --output json
  

• pipe the simulation result to kubeseal

  kubectl --namespace test-secrets create secret generic mysecret \
  --dry-run=client --from-literal foo=bar --output json | kubeseal \
  --controller-namespace=sealed-secrets
  

• pipe the simulation result to kubeseal with yaml format

  kubectl --namespace test-secrets create secret generic mysecret \
  --dry-run=client --from-literal foo=bar --output json | kubeseal \
  --controller-namespace=sealed-secrets -o yaml
  

• pipe the kubeseal output to mysecret.yaml

  kubectl --namespace test-secrets create secret generic mysecret \
  --dry-run=client --from-literal foo=bar --output json | kubeseal \
  --controller-namespace=sealed-secrets -o yaml | tee mysecret.yaml
  

• try to simulate to create resource using mysecret.yaml

  kubectl create --filename mysecret.yaml --dry-run=client
  

• create resource using mysecret.yaml

  kubectl create --filename mysecret.yaml
  

• get sealedsecrets resource

  kubectl -n test-secrets get sealedsecrets.bitnami.com
  

• get sealedsecrets resource mysecret

  kubectl -n test-secrets get sealedsecrets.bitnami.com mysecret
  

• output sealedsecrets resource mysecret in yaml format

  kubectl -n test-secrets get sealedsecrets.bitnami.com mysecret -o yaml
  

• output sealedsecrets resource mysecret in json format

  kubectl -n test-secrets get sealedsecrets.bitnami.com mysecret -o json
  

• get secrets resource

  kubectl -n test-secrets get secrets
  

• output secrets resource mysecret in yaml format

  kubectl -n test-secrets get secrets mysecret --output yaml
  

• output a value from secrets resource mysecret in jsonpath format

  kubectl -n test-secrets get secrets mysecret \
  --output jsonpath="{.data.foo}"
  

• decode base64 a value from secrets resource mysecret in jsonpath format

  kubectl -n test-secrets get secrets mysecret \
  --output jsonpath="{.data.foo}" | base64 --decode && echo
  

• fetch sealed-secrets controller certificate

  kubeseal --controller-namespace=sealed-secrets --fetch-cert