sealed-secrets

GitOps source for the cluster Sealed Secrets controller.

Current deployment

• Bootstrap: enabled: true, applied from main
• Argo application: sealed-secrets-production
• Target namespace: kube-system
• Helm chart: bitnami-labs/sealed-secrets
• Chart version: 2.18.5
• Helm release name: sealed-secrets-controller

Runtime

Argo CD renders the upstream Helm chart with values from manifest/overlays/production/helm-values/values.yaml. The controller name is kept as sealed-secrets-controller so kubeseal works with its default controller-name assumptions.

Secret migration workflow

Fetch the controller cert with kubeseal --fetch-cert --controller-namespace kube-system, seal app secrets into the owning app repo, then remove old SOPS/KSOPS secret generator entries only after the app syncs from the new SealedSecret path.