# Securing Kubernetes Secrets with Sealed Secrets: A Hands-On Guide

We have seen why we want to secure our secrets in our last blog. If you haven't read that please read that using below link.

%[https://ajayproject.com/securing-secrets-in-the-cloud-a-hands-on-guide-to-hashicorp-vault] 

  
In this blog we will explore sealed secrets.

We need to install Controller and Kubeseal to use sealed secret.

1. First install Controller using below helm command.
    

```yaml
helm repo add sealed-secrets https://bitnami-labs.github.io/sealed-secrets
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722115402570/abc246bc-d74d-471e-80bd-a3f04a98caa0.png align="center")

2. Now install it using below command.
    

```yaml
helm install sealed-secrets -n sealed-secret sealed-secrets/sealed-secrets --create-namespace
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722115657275/da4a259b-49c7-4db1-8fa6-150a3d647f6a.png align="center")

3. Now install Kubeseal using below command if you are using mac:
    

```yaml
brew install kubeseal
```

If you are using any other operating system then you can install kubeseal using [this link](https://github.com/bitnami-labs/sealed-secrets?tab=readme-ov-file#kubeseal)

4. Create secret manifest file(Which can be shared over github or other source code repo) using following command.
    

```yaml
kubectl create secret generic database-cred --dry-run=client --from-literal=username=admin --from-literal=password=supersecret -oyaml | \
    kubeseal \
      --controller-name=sealed-secrets \
      --controller-namespace=sealed-secret \
      --format yaml > mysealedsecret.yaml
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722116271289/d40300af-9ff3-4382-b849-803699431298.png align="center")

Now if check you secret manifest file. You will see your secret data is now sealed. Even if you upload on any source code repo , it is still secure . No one can decrypt it.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722116344159/ed4e011b-9bc8-44ff-a9fb-2405f93a2730.png align="center")

Whenever you will use this manifest file then it will be convert into base64 format in secret by sealed-secret.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722116536587/0899303c-f497-405a-8769-391d9fca026e.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722116597956/d249eb05-25ca-4c9b-9bcb-06db6951e55d.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722116630451/dc77cd0f-827b-4282-b9e2-d53ded1856ae.png align="center")

By following these steps, you can securely store your secrets in Kubernetes using Sealed Secrets. This method ensures that your sensitive data remains encrypted, even if the manifest files are stored in a version control system or shared publicly. However, it's important to note that **Sealed Secrets do not support automatic rotation of secrets. This means that if your secret data changes frequently, you'll need to manually update and reseal your secrets.**

In our next blog, we will explore another method for managing secrets in Kubernetes: External Secret Operator (ESO) with Google Secret Manager. This approach offers dynamic secret management and may address some of the limitations of Sealed Secrets. Stay tuned!