World map

 

BM

World K4: Notes, Lockers & Packages

External Secrets and Sealed Secrets

You will learn: two ways to keep passwords safe when Git holds your whole setup.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

This file sits in a public Git repo. Tap the line a stranger can read.

0 of 1 found

Your team keeps every YAML file in Git. That is great, until one file is a Secret. How do you store passwords with everything else?

Watch

Put the Sealed Secret: A Secret locked with the cluster's public key, safe to keep in Git. Only the controller in the cluster can open it. steps in order, first at the top.

First step at the top. Put these in order. Use the arrows, or drag.

  • Write the Secret YAML on your laptop (a dry run)
  • The controller unlocks it into a normal Secret
  • kubeseal locks it with the cluster public key
  • Apply it to the cluster
  • Commit the SealedSecret file to Git

Only the controller in the cluster holds the private key.

Watch

bash
kubectl create secret generic till --from-literal=PASSWORD=sup3r-rahsia --dry-run=client -o yaml > secret.yaml
kubeseal --format yaml < secret.yaml > sealed-secret.yaml
rm secret.yaml

--dry-run=client writes the Secret to a file only. kubeseal locks it. Commit the sealed file, and throw away the plain one.

Watch

Drag a card into a box. Or tap the card, then tap the box.

        The External Secrets Operator: Copies secrets from an outside vault into Kubernetes Secrets, and keeps them fresh. keeps the password in an outside vault. It copies it into a Secret, and keeps it fresh.

        Predict

        Your company already keeps passwords in a cloud vault. Which tool fits best?

        Check

        Safe to commit to Git? Swipe each file.

        Swipe right for good, left for needs work. Or use the buttons.

        1 / 4

        sealed-secret.yaml made by kubeseal

        You did it!

        You can now keep passwords safe when Git holds your setup.

        Go deeper (optional)

        Both tools end with a plain Secret. So RBAC and encryption at rest still matter. A sealed file opens only with the same name and namespace. Back up the controller’s private key. Lose it, and old sealed files never open. Other tools: SOPS, and the Secrets Store CSI driver.

        Real rep (optional), on a practice cluster only:

        Real mission

        2. kubectl create secret generic till --from-literal=PASSWORD=practice-only --dry-run=client -o yaml > secret.yaml
        3. kubeseal --format yaml < secret.yaml > sealed-secret.yaml
        4. kubectl apply -f sealed-secret.yaml
        5. kubectl get secret till
        6. rm secret.yaml

        0 of 6 steps done · Your ticks are saved.