Bitnami Sealed Secrets is a Kubernetes controller and CLI tool that enables secure storage of encrypted Kubernetes Secrets in version control. The system consists of a cluster-side operator and a client-side CLI (`kubeseal`). The controller watches for custom `SealedSecret` custom resource definitions (CRDs) and decrypts them into regular Kubernetes `Secret` objects using asymmetric encryption (RSA-OAEP for key encapsulation and AES-256-GCM for data encryption). The CLI allows users to encrypt secrets using the controller's public certificate, validate sealed secrets, and re-encrypt them under different keys. The controller is deployed via a Helm chart or raw manifests, exposes Prometheus metrics, and provides HTTP endpoints for certificate retrieval, verification, and key rotation. The codebase is mature, well-tested with both unit and integration tests, and follows standard Kubernetes operator patterns (informers, work queues, status updates). It has a low technical drift, with recent dependency updates and active maintenance.
OVH CDS is an enterprise-grade continuous delivery and DevOps automation platform. The repository contains a set of Go services (API, CDN, hooks, VCS, repositories, hatcheries, worker, elasticsearch) managed via a common engine binary, supported by PostgreSQL, Redis, and OpenSearch/Elasticsearch, plus an Angular web UI, a cdsctl CLI, and gRPC-based action/integration plugins. In production it orchestrates pipelines and workflows, spawns workers on Kubernetes, Swarm, OpenStack, vSphere or local hosts, ingests VCS webhooks, stores job logs and artifacts through a pluggable CDN storage layer, and enforces fine-grained RBAC across projects, regions, workflows, and variable sets. Both legacy v1 workflows and newer as-code v2 workflows are implemented and actively maintained side-by-side.