Bitnami Sealed Secrets is a Kubernetes controller and CLI tool that enables secure storage of encrypted Kubernetes Secrets in version control. The system consists of a cluster-side operator and a client-side CLI (`kubeseal`). The controller watches for custom `SealedSecret` custom resource definitions (CRDs) and decrypts them into regular Kubernetes `Secret` objects using asymmetric encryption (RSA-OAEP for key encapsulation and AES-256-GCM for data encryption). The CLI allows users to encrypt secrets using the controller's public certificate, validate sealed secrets, and re-encrypt them under different keys. The controller is deployed via a Helm chart or raw manifests, exposes Prometheus metrics, and provides HTTP endpoints for certificate retrieval, verification, and key rotation. The codebase is mature, well-tested with both unit and integration tests, and follows standard Kubernetes operator patterns (informers, work queues, status updates). It has a low technical drift, with recent dependency updates and active maintenance.