bitnami-labs/sealed-secrets
Sealed Secrets
Sealed Secrets is a Kubernetes secret encryption tool and controller designed for GitOps security. It provides a mechanism to encrypt sensitive data into specialized resources that can be safely stored in public version control systems and decrypted only within a cluster.
The system uses an asymmetric encryption manager to seal secrets with a public key, ensuring that only the corresponding private key held within the cluster can unseal them. It includes utilities for security key rotation, secret re-encryption, and offline private key recovery to maintain data access during disaster recovery scenarios.
The controller manages the automated transformation of encrypted resources into standard Kubernetes secrets. It supports decryption scope control based on resource names and namespaces, as well as encrypted secret validation to verify resources without performing an actual unsealing process.
Features
- GitOps Secret Management - Enables storing encrypted secrets in public version control systems for safe GitOps-based delivery.
- Secrets Deployment Pipelines - Automates the transformation of encrypted resources into standard Kubernetes secrets during the deployment process.
- Control Loops - Utilizes a Kubernetes-style reconciliation loop to automatically synchronize encrypted resources into standard secrets.
- Custom Resource Definitions - Defines a specialized Kubernetes custom resource for storing and managing encrypted secrets.
- Kubernetes Controllers - Implements a Kubernetes controller that monitors for encrypted resources and transforms them into secrets.
- Encrypted Secret Management - Protects sensitive Kubernetes configuration data using asymmetric cryptography to prevent plain text exposure.
- Encryption Key Management - Provides a system for managing the lifecycle of public and private keys used for sealing secrets.
- Asymmetric Encryption - Implements asymmetric encryption to secure sensitive data using public-private key pairs.
- In-Cluster Secret Stores - Maintains the decryption private key natively within the cluster to ensure data never leaves the secure boundary.
- Version-Controlled Secret Encryption - Encrypts sensitive data into resources that can be safely stored in public version control.
- Namespaced - Restricts the controller's monitoring scope to specific namespaces for better isolation and security.
- Resource Scope Definitions - Allows restricting the controller's scope to specific namespaces rather than monitoring the entire cluster.
- Decryption Scopes - Prevents unauthorized data movement by restricting decryption to specific resource names and namespaces.
- Secret Re-encryptions - Allows updating encrypted resources to use the latest private keys without decrypted data leaving the cluster.
- Offline Recovery - Provides utilities for manual decryption of secrets using backup private keys during disaster recovery.
- Automated Key Rotations - Supports updating encryption keys on a regular schedule to ensure secrets use current security certificates.
- Encrypted Secret Backups - Implements a mechanism to decrypt secret files using backed-up private keys for disaster recovery.
- Secret Recovery - Enables restoring access to encrypted configuration data using offline private key backups.
- Distributed Monitoring - Encrypts Kubernetes secrets for safe storage in version control.
- Secrets Management - One-way encrypted secrets controller for Kubernetes.
