Managing secrets in git

[desyncit]

This was a little tricky to figure out but, there is a problem with managing secrets in gitub. We don't want to store them in base64 encoded strings as that would defeat the purpose of having secrets.

Problem: "I can manage all my K8s config in git, except Secrets."
Solution: Encrypt your Secret into a SealedSecret, which is safe to store - even inside a public repository. The SealedSecret can be decrypted only by the controller running in the target cluster and nobody else (not even the original author) is able to obtain the original Secret from the SealedSecret.

• Github | SealedSecret
• Client util | kubeseal

Basic operation

# create a secret 
 $ >> echo 'super secret message' > secretmessage.txt
 $ >> oc create secret secret-message
 $ >> oc create secret generic secret-message --from-file secretmessage.txt 
secret/secret-message created

# export secret and then delete it. We do this so we don't have to write the yaml ourselves
$ >> oc get secret/secret-message -o yaml > secret-message.yaml
$ >> oc delete secret/secret-message
secret "secret-message" deleted

# now seal the exported secret and and create it inside of the cluster. 
 $ >> kubeseal --controller-name sealed-secrets-controller --controller-namespace  sealed-secrets  --scope strict < secret-message.yaml > sealed-secret-message.json
 $ >> oc create -f sealed-secret-message.json
sealedsecret.bitnami.com/sealed-secret-message created

Now we just verify the sealed secrets and the secret managed by the sealed-secret-controller is deployed.

 $ >> oc get sealedsecrets
NAME             STATUS   SYNCED   AGE
secret-message            True     13m

 $ >> oc get secrets secret-message -o yaml
apiVersion: v1
data:
  secretmessage.txt: c3VwZXIgc2VjcmV0IG1lc3NhZ2UK
kind: Secret
metadata:
  creationTimestamp: "2025-07-05T18:58:19Z"
  name: secret-message
  namespace: snickle
  ownerReferences:
  - apiVersion: bitnami.com/v1alpha1
    controller: true
    kind: SealedSecret
    name: secret-message
    uid: 5d4a393d-2688-4e1e-ba44-4d193bd17c80
  resourceVersion: "8525649"
  uid: 72eb8592-d14e-4e9c-a296-540e0bee0963
type: Opaque