Sealed Secrets packaged by Bitnami¶

Sealed Secrets are "one-way" encrypted K8s Secrets that can be created by anyone, but can only be decrypted by the controller running in the target cluster recovering the original object.

Overview of Sealed Secrets

TL;DR¶

使用加速地址添加仓库:

helm repo add bitnami "https://helm-charts.itboon.top/bitnami" --force-update
helm update bitnami

helm install my-release bitnami/sealed-secrets

Introduction¶

Bitnami charts for Helm are carefully engineered, actively maintained and are the quickest and easiest way to deploy containers on a Kubernetes cluster that are ready to handle production workloads.

This chart bootstraps a Sealed Secret controller Deployment in Kubernetes using the Helm package manager.

Bitnami charts can be used with Kubeapps for deployment and management of Helm Charts in clusters.

Looking to use Sealed Secrets in production? Try VMware Application Catalog, the enterprise edition of Bitnami Application Catalog.

Prerequisites¶

• Kubernetes 1.16+
• Helm 3.1.0

Installing the Chart¶

To install the chart with the release name my-release:

helm install my-release bitnami/sealed-secrets

The command deploys the Sealed Secrets controller on the Kubernetes cluster in the default configuration. The Parameters section lists the parameters that can be configured during installation.

Tip: List all releases using helm list

Uninstalling the Chart¶

To uninstall/delete the my-release deployment:

helm delete my-release

The command removes all the Kubernetes components associated with the chart and deletes the release.

Parameters¶

Global parameters¶

Common parameters¶

Sealed Secrets Parameters¶

Traffic Exposure Parameters¶

Other Parameters¶

Metrics parameters¶

Specify each parameter using the --set key=value[,key=value] argument to helm install. For example,

helm install my-release \
  --set livenessProbe.successThreshold=5 \
    bitnami/sealed-secrets

The above command sets the livenessProbe.successThreshold to 5.

Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,

helm install my-release -f values.yaml bitnami/sealed-secrets

Tip: You can use the default values.yaml

Configuration and installation details¶

Using kubeseal¶

The easiest way to interact with the Sealed Secrets controller is using the kubeseal utility. You can install this CLI by downloading the binary from sealed-secrets/releases page.

Once installed, you can start using it to encrypt your secrets or fetching the controller public certificate as shown in the example below:

$ kubeseal --fetch-cert \
--controller-name=my-release \
--controller-namespace=my-release-namespace \
> pub-cert.pem

Refer to Sealed Secrets documentation for more information about kubeseal usage.

Rolling VS Immutable tags¶

It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image.

Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist.

Ingress¶

This chart provides support for Ingress resources. If you have an ingress controller installed on your cluster, such as nginx-ingress-controller or contour you can utilize the ingress controller to serve your application.

To enable Ingress integration, set ingress.enabled to true. The ingress.hostname property can be used to set the host name. The ingress.tls parameter can be used to add the TLS configuration for this host. It is also possible to have more than one host, with a separate TLS configuration for each host. Learn more about configuring and using Ingress.

TLS secrets¶

The chart also facilitates the creation of TLS secrets for use with the Ingress controller, with different options for certificate management. Learn more about TLS secrets.

Sidecars¶

If additional containers are needed in the same pod as Sealed Secrets (such as additional metrics or logging exporters), they can be defined using the sidecars parameter. If these sidecars export extra ports, extra port definitions can be added using the service.extraPorts parameter. Learn more about configuring and using sidecar containers.

Pod affinity¶

This chart allows you to set your custom affinity using the affinity parameter. Find more information about Pod affinity in the kubernetes documentation.

As an alternative, use one of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the bitnami/common chart. To do so, set the podAffinityPreset, podAntiAffinityPreset, or nodeAffinityPreset parameters.

Troubleshooting¶

Find more information about how to deal with common errors related to Bitnami's Helm charts in this troubleshooting guide.

Upgrading¶

To 1.0.0¶

This major release renames several values in this chart and adds missing features, in order to be aligned with the rest of the assets in the Bitnami charts repository.

• service.port has been renamed as service.ports.http.
• service.nodePorthas been renamed as service.nodePorts.http
• containerPorthas been renamed as containerPorts.http
• certManagerhas been removed. Please use ingress.annotations instead

License¶

Copyright © 2023 VMware, Inc.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.