Lion Cipher Lab
Safely store Kubernetes secrets in Git with Sealed Secrets
- Cloud Security
- Intermediate
- ~50 min
- Free · no account required
Why it matters
The moment a team adopts GitOps — where a tool like Argo CD or Flux continuously applies whatever Kubernetes YAML lives in a Git repository — someone asks the obvious question: what about the passwords? A Kubernetes Secret looks encrypted because its values are base64 blobs, but base64 is just an encoding anyone can reverse in one command, so committing a plain Secret to Git is identical to committing the password in cleartext. Sealed Secrets solves this cleanly: a controller running in the cluster holds a private key, the `kubeseal` tool encrypts your Secret with the matching public key into…
What you'll learn
- why a Kubernetes Secret is base64, not encrypted
- encrypting a Secret with kubeseal into a SealedSecret
- installing and reasoning about the sealed-secrets controller
- GitOps-safe secret management
- SealedSecret scope (strict / namespace-wide / cluster-wide)
- controller key rotation and backup
- knowing when a real KMS or External Secrets is the right call instead
Steps in this lab
- The problem, in one breath: base64 is not encryption
- Build a throwaway cluster with kind
- Create a normal Secret — then decode it and watch the password fall out
- Install the sealed-secrets controller (into kube-system)
- Install the kubeseal CLI
- Seal the Secret — encrypt it into a SealedSecret you can commit
- Apply the SealedSecret and watch the controller materialize a real Secret
- Prove the scope rule: a SealedSecret is bound to its name AND namespace
- The key IS the crown jewel: back it up and understand rotation
- The judgment: when to reach for this, when NOT to, and how a pro does it