$ show bitnami/sealed-secrets
Bitnami Sealed Secrets is a Kubernetes controller and CLI tool that enables secure storage of encrypted Kubernetes Secrets in version control. The system consists of a cluster-side operator and a client-side CLI (`kubeseal`). The controller watches for custom `SealedSecret` custom resource definitions (CRDs) and decrypts them into regular Kubernetes `Secret` objects using asymmetric encryption (RSA-OAEP for key encapsulation and AES-256-GCM for data encryption). The CLI allows users to encrypt secrets using the controller's public certificate, validate sealed secrets, and re-encrypt them under different keys. The controller is deployed via a Helm chart or raw manifests, exposes Prometheus metrics, and provides HTTP endpoints for certificate retrieval, verification, and key rotation. The codebase is mature, well-tested with both unit and integration tests, and follows standard Kubernetes operator patterns (informers, work queues, status updates). It has a low technical drift, with recent dependency updates and active maintenance.
The LLM identified 6 files worth highlighting for reuse:
Implements hybrid encryption combining RSA-OAEP for key wrapping and AES-256-GCM for payload encryption. Self-contained, well-documented, and testable. Reusable in any Go application requiring secure encryption/decryption with asymmetric keys.
Provides a simple utility to bind flag definitions to environment variables, allowing CLI arguments to be overridden by env vars. Reusable pattern for Go CLI tools to support 12-factor app configuration.
A small utility to split a YAML stream containing multiple documents separated by `---` into individual YAML documents. Reusable for any Go application that needs to parse multi-document YAML files.
Contains the core logic for client-side sealing of secrets using the controller's public certificate. Demonstrates a clean pattern for encrypting data with a remote public key. Could be extracted as a library for other tools needing similar sealing functionality.
Manages RSA key pairs with thread-safe access via sync.RWMutex, including key generation, rotation, and lookup by label. Reusable pattern for managing cryptographic keys in a concurrent environment.
Implements a minimal logging handler that routes log messages to different outputs based on severity (e.g., info to stdout, errors to stderr). Reusable pattern for Go applications needing simple multi-stream logging.