# bitnami-labs/sealed-secrets architecture

> Architecture diagram of the GitHub repository bitnami-labs/sealed-secrets, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/bitnami-labs/sealed-secrets
- Repository: https://github.com/bitnami-labs/sealed-secrets

## Overview

Sealed Secrets lets users encrypt Kubernetes Secret data into a SealedSecret for storage and later application to a cluster. The principal path is kubeseal input, public-key encryption, SealedSecret submission, controller reconciliation and decryption, then creation or update of a Kubernetes Secret. The controller also manages sealing keys and exposes certificate, validation, rotation, health, and metrics endpoints. The graph reflects the documented workflow and sampled code; some callback wiring and CLI internals were not sampled, so uncertain links are omitted.

Main entry points: [`pkg/kubeseal/kubeseal.go`](https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/kubeseal/kubeseal.go) (Seal and validate), [`pkg/controller/main.go`](https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/controller/main.go) (Controller startup), [`pkg/controller/server.go`](https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/controller/server.go) (HTTP endpoints), [`pkg/controller/controller.go`](https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/controller/controller.go) (Reconciliation loop)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_client["Client sealing"]
  node_kubeseal_cli["kubeseal CLI<br/>[main.go]"]
  node_seal_lib["Seal and validate<br/>[kubeseal.go]"]
  node_crypto["Hybrid crypto<br/>[crypto.go]"]
  node_sealedsecret["SealedSecret resource<br/>[types.go]"]
end

subgraph group_controller["Cluster controller"]
  node_controller_bin["Controller process<br/>[main.go]"]
  node_controller_main["Controller startup<br/>[main.go]"]
  node_reconciler["Reconciliation loop<br/>[controller.go]"]
end

subgraph group_keys["Key management"]
  node_key_registry["Key registry<br/>[keyregistry.go]"]
  node_key_ops["Key operations<br/>[keys.go]"]
end

subgraph group_operations["Operations endpoints"]
  node_http_server["HTTP endpoints<br/>[server.go]"]
  node_metrics["Controller metrics<br/>[metrics.go]"]
end

node_user(("Secret author"))
node_cluster_api[("Kubernetes API")]
node_prometheus(("Prometheus"))

node_user -->|"provides input"| node_kubeseal_cli
node_kubeseal_cli -->|"invokes"| node_seal_lib
node_seal_lib -->|"encrypts with"| node_crypto
node_seal_lib -->|"produces"| node_sealedsecret
node_kubeseal_cli -->|"submits resource"| node_cluster_api
node_seal_lib -.->|"fetches certificate"| node_cluster_api
node_controller_bin -->|"starts"| node_controller_main
node_controller_main -->|"creates clients"| node_cluster_api
node_controller_main -->|"initializes"| node_key_registry
node_controller_main -->|"starts"| node_reconciler
node_reconciler -->|"watches and updates"| node_cluster_api
node_reconciler -->|"decrypts with"| node_crypto
node_reconciler -->|"uses keys"| node_key_registry
node_key_registry -->|"reads and stores keys"| node_cluster_api
node_controller_main -->|"starts"| node_http_server
node_http_server -->|"exposes metrics"| node_metrics
node_prometheus -.->|"scrapes"| node_http_server
node_user -.->|"requests operations"| node_http_server
node_seal_lib -.->|"validates or rotates via proxy"| node_http_server
node_key_registry -->|"manages key lifecycle"| node_key_ops

click node_kubeseal_cli "https://github.com/bitnami-labs/sealed-secrets/blob/main/cmd/kubeseal/main.go"
click node_seal_lib "https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/kubeseal/kubeseal.go"
click node_crypto "https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/crypto/crypto.go"
click node_sealedsecret "https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/apis/sealedsecrets/v1alpha1/types.go"
click node_controller_bin "https://github.com/bitnami-labs/sealed-secrets/blob/main/cmd/controller/main.go"
click node_controller_main "https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/controller/main.go"
click node_reconciler "https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/controller/controller.go"
click node_key_registry "https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/controller/keyregistry.go"
click node_key_ops "https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/controller/keys.go"
click node_http_server "https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/controller/server.go"
click node_metrics "https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/controller/metrics.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_kubeseal_cli,node_seal_lib,node_crypto,node_sealedsecret toneBlue
class node_controller_bin,node_controller_main,node_reconciler,node_cluster_api toneAmber
class node_key_registry,node_key_ops toneMint
class node_http_server,node_metrics toneRose
class node_user,node_prometheus toneIndigo
```

## Components

### Client sealing

- [kubeseal CLI](https://github.com/bitnami-labs/sealed-secrets/blob/main/cmd/kubeseal/main.go): `cmd/kubeseal/main.go`
- [Seal and validate](https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/kubeseal/kubeseal.go): `pkg/kubeseal/kubeseal.go`
- [Hybrid crypto](https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/crypto/crypto.go): `pkg/crypto/crypto.go`
- [SealedSecret resource](https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/apis/sealedsecrets/v1alpha1/types.go): `pkg/apis/sealedsecrets/v1alpha1/types.go`

### Cluster controller

- [Controller process](https://github.com/bitnami-labs/sealed-secrets/blob/main/cmd/controller/main.go): `cmd/controller/main.go`
- [Controller startup](https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/controller/main.go): `pkg/controller/main.go`
- [Reconciliation loop](https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/controller/controller.go): `pkg/controller/controller.go`

### Key management

- [Key registry](https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/controller/keyregistry.go): `pkg/controller/keyregistry.go`
- [Key operations](https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/controller/keys.go): `pkg/controller/keys.go`

### Operations endpoints

- [HTTP endpoints](https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/controller/server.go): `pkg/controller/server.go`
- [Controller metrics](https://github.com/bitnami-labs/sealed-secrets/blob/main/pkg/controller/metrics.go): `pkg/controller/metrics.go`

### Other components

- **Secret author**
- **Kubernetes API**
- **Prometheus**

## Connections

- Secret author → kubeseal CLI: provides input
- kubeseal CLI → Seal and validate: invokes
- Seal and validate → Hybrid crypto: encrypts with
- Seal and validate → SealedSecret resource: produces
- kubeseal CLI → Kubernetes API: submits resource
- Seal and validate → Kubernetes API: fetches certificate
- Controller process → Controller startup: starts
- Controller startup → Kubernetes API: creates clients
- Controller startup → Key registry: initializes
- Controller startup → Reconciliation loop: starts
- Reconciliation loop → Kubernetes API: watches and updates
- Reconciliation loop → Hybrid crypto: decrypts with
- Reconciliation loop → Key registry: uses keys
- Key registry → Kubernetes API: reads and stores keys
- Controller startup → HTTP endpoints: starts
- HTTP endpoints → Controller metrics: exposes metrics
- Prometheus → HTTP endpoints: scrapes
- Secret author → HTTP endpoints: requests operations
- Seal and validate → HTTP endpoints: validates or rotates via proxy
- Key registry → Key operations: manages key lifecycle