secretgen-controller is a Kubernetes operator that automates the generation and sharing of secrets within a cluster. It defines custom resources (Certificate, Password, RSAKey, SSHKey) that produce corresponding Kubernetes secrets, and provides cross-namespace secret export/import via SecretExport and SecretImport CRDs. Additionally, a SecretTemplate CRD allows constructing secrets from data in arbitrary Kubernetes resources using JSONPath expressions. The controller is part of the Carvel tool suite and is built with controller-runtime, using generated clientsets and informers for both the original secretgen.k14s.io API group and the newer secretgen.carvel.dev group. The architecture follows the standard Kubernetes operator pattern: a single controller binary (cmd/controller/main.go) registers multiple reconcilers for each CRD, plus a SecretReconciler that handles image pull secret merging from exported secrets. Reconcilers use a thread-safe tracker to watch input resources and a generic status helper to update conditions. Secret generation relies on the cloudfoundry/config-server library for cryptographic operations, with FIPS 140-3 support added for SSH key fingerprints and certificate SubjectKeyId. The sharing subsystem maintains an in-memory cache of secret exports with sorting and weight logic to resolve conflicts. The codebase is well-structured with clear separation of concerns, comprehensive end-to-end tests, and a robust CI/CD pipeline. However, it carries some technical debt: two API groups that may diverge, heavy reliance on code generation, and potential performance issues from listing all resources on every relevant event. The use of panic statements in shared code and the custom fork of cloudfoundry/config-server introduce maintenance risks. Overall, it is a production-grade operator suitable for managing secrets in Kubernetes environments.