How bitnami-labs/sealed-secrets works
Sealed Secrets lets users encrypt Kubernetes Secret data into a SealedSecret for storage and later application to a cluster. The principal path is kubeseal input, public-key encryption, SealedSecret submission, controller reconciliation and decryption, then creation or update of a Kubernetes Secret. The controller also manages sealing keys and exposes certificate, validation, rotation, health, and metrics endpoints. The graph reflects the documented workflow and sampled code; some callback wiring and CLI internals were not sampled, so uncertain links are omitted.
Main entry points: kubeseal.go Seal and validate · main.go Controller startup · server.go HTTP endpoints · controller.go Reconciliation loop
Components 14
Client sealing
- kubeseal CLI
cmd/kubeseal/main.go - Seal and validate
pkg/kubeseal/kubeseal.go - Hybrid crypto
pkg/crypto/crypto.go - SealedSecret resource
pkg/apis/sealedsecrets/v1alpha1/types.go
Cluster controller
- Controller process
cmd/controller/main.go - Controller startup
pkg/controller/main.go - Reconciliation loop
pkg/controller/controller.go
Key management
- Key registry
pkg/controller/keyregistry.go - Key operations
pkg/controller/keys.go
Operations endpoints
- HTTP endpoints
pkg/controller/server.go - Controller metrics
pkg/controller/metrics.go
Other components
- Secret author
- Kubernetes API
- Prometheus
Connections 20
- Secret author → kubeseal CLI: provides input
- kubeseal CLI → Seal and validate: invokes
- Seal and validate → Hybrid crypto: encrypts with
- Seal and validate → SealedSecret resource: produces
- kubeseal CLI → Kubernetes API: submits resource
- Seal and validate → Kubernetes API: fetches certificate
- Controller process → Controller startup: starts
- Controller startup → Kubernetes API: creates clients
- Controller startup → Key registry: initializes
- Controller startup → Reconciliation loop: starts
- Reconciliation loop → Kubernetes API: watches and updates
- Reconciliation loop → Hybrid crypto: decrypts with
- Reconciliation loop → Key registry: uses keys
- Key registry → Kubernetes API: reads and stores keys
- Controller startup → HTTP endpoints: starts
- HTTP endpoints → Controller metrics: exposes metrics
- Prometheus → HTTP endpoints: scrapes
- Secret author → HTTP endpoints: requests operations
- Seal and validate → HTTP endpoints: validates or rotates via proxy
- Key registry → Key operations: manages key lifecycle