Migrating Kubernetes Secrets to Sealed Secrets

Secrets in Kubernetes are convenient resources for managing sensitive information, but handling them in plain text carries security risks. One way to solve this is by using Sealed Secrets.

In this article, I will introduce the steps to migrate an existing Secret resource to a Sealed Secret.

---

1. Copy the Existing Secret to the Clipboard

First, retrieve the existing Secret in yaml format and copy it to your clipboard.

k get secret [your-secret-name] -o yaml | pbcopy

---

2. Create manifests/secret.yaml

Paste the contents of your clipboard into a newly created manifests/secret.yaml.

Since this file contains sensitive information, be sure to exclude it from Git's tracking.

echo "manifests/secret.yaml" >> .gitignore

---

3. Create a Sealed Secret

Create a Sealed Secret based on secret.yaml using the following command.

kubeseal \
  --controller-name=sealed-secrets \
  --controller-namespace=[your-namespace] \
  --format=yaml < secret.yaml > manifests/sealed-secret.yaml

---

4. Delete the Existing Secret

Delete the original Secret to switch to the Sealed Secret.

k delete secret [your-secret-name]

---

5. Apply the Sealed Secret

Apply the created sealed-secret.yaml.

k apply -f manifests/sealed-secret.yaml

---

6. Confirm the Sealed Secret

Verify that the resource has been created with the following command.

k get sealedsecrets

---

7. No Changes Needed on the Deployment Side

Since the Sealed Secret is decrypted and deployed as a standard Secret by the Controller, the settings on the Deployment or Pod side can remain exactly as they are.

---

Conclusion

With this, the steps to replace the Secret with a Sealed Secret are complete.
You can now safely integrate it into your CI/CD pipelines and manage it within Git with peace of mind.