Automic VaultAutomic Vault

brew

kubeseal mit Homebrew, apk, MacPorts, Nix, pacman, zypper, scoop installieren

Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für kubeseal in AI-Agent-Workflows.

InstallationsbefehlSicherheitshinweise

Agent-Sicherheit

Antwort zur Agent-Sicherheit

kubeseal transforms Kubernetes secrets and is tied to cluster secret-management workflows.

Credential-Zugriff

Handles secret manifests and cluster public keys; input files may contain sensitive values.

Änderungen an Remote-Zustand

Does not usually mutate clusters directly, but output is intended for cluster application.

Publish-/Artefakt-Risiko

Can produce sealed secret artifacts committed or deployed to clusters.

Empfohlene Kontrolle

Gate commands that read plaintext secret files or write deployable sealed secrets.

Hinweise für Agent-Nutzung

Allow public-key fetches; require approval before processing plaintext secrets or writing manifests.

Installation

Weitere Installationsbefehle

macOS

Homebrewverifiziert · 100%
brew install kubeseal

local Homebrew formula metadata

MacPortsverifiziert · 94%
sudo port install kubeseal

MacPorts ports tree · sysutils/kubeseal/Portfile · Quelle: api.github.com

Linux

Alpine Linux apkverifiziert · 92%
sudo apk add kubeseal

Alpine Linux edge package indexes · kubeseal · Quelle: dl-cdn.alpinelinux.org

Nixverifiziert · 92%
nix profile install nixpkgs#kubeseal

nixpkgs package indexes · pkgs/by-name/ku/kubeseal/package.nix · Quelle: api.github.com

Arch Linux pacmanverifiziert · 92%
sudo pacman -S kubeseal

Arch Linux sync databases · kubeseal · Quelle: geo.mirror.pkgbuild.com

openSUSE zypperverifiziert · 92%
sudo zypper install kubeseal

openSUSE Tumbleweed package metadata · kubeseal · Quelle: download.opensuse.org

Windows

Scoopverifiziert · 92%
scoop install main/kubeseal

Scoop official bucket manifest trees · bucket/kubeseal.json · Quelle: api.github.com

Überblick

Paketzusammenfassung

Kubernetes controller and tool for one-way encrypted Secrets

Befehle und Aliase

  • kubeseal

Verlauf

Projektgeschichte und Nutzung

kubeseal is the client-side utility for Bitnami Sealed Secrets, a Kubernetes controller and custom resource pattern for storing encrypted Secrets safely in Git.

Projektgeschichte

Sealed Secrets addresses the GitOps-era problem of managing Kubernetes configuration in version control while keeping Secret values encrypted. The project is split into a cluster-side controller/operator and the kubeseal CLI. kubeseal uses asymmetric cryptography to encrypt a Kubernetes Secret into a SealedSecret custom resource that only the target cluster's controller can decrypt.

Adoptionsgeschichte

kubeseal became a common companion tool for teams that wanted declarative Kubernetes deployments without introducing an external secret store into every workflow. Its release notes and README document distribution through Homebrew, MacPorts, Nixpkgs, Linux binaries, and controller manifests.

Wie es verwendet wird

A typical workflow creates or exports a Kubernetes Secret manifest, pipes it through kubeseal, commits the resulting SealedSecret YAML, and lets the in-cluster controller unseal it back into a normal Kubernetes Secret.

Warum Paket-Nerds sich dafür interessieren

kubeseal is package-nerd interesting because the CLI is only half of the product: the packaged binary must line up with a CRD/controller deployed in the cluster. It also turned a security-sensitive Kubernetes workflow into a small Unix-friendly command-line transform.

Zeitleiste

  • 2026: The v0.38.1 release page listed controller installation YAML and kubeseal client binaries, including Homebrew instructions for macOS.

Related projects

  • Related tools and patterns include Kubernetes Secrets, GitOps controllers such as Argo CD and Flux, external-secrets operators, SOPS, and cloud KMS-backed secret-management workflows.

Sicherheitslage

Risikostufe: orange

broad file, network, media, or database tool signal. infrastructure mutation or orchestration signal.

Risikoklassifikator

orange Risiko · mittel Konfidenz · infrastructure

Warum

  • broad file, network, media, or database tool signal
  • infrastructure mutation or orchestration signal

Signale

  • text:encrypt
  • text:kubernetes

Installationsverhalten

  • In den Formelmetadaten ist kein Homebrew-Post-install-Hook erfasst.
  • Homebrew-Bottle-Metadaten sind für 6 Plattformziele verfügbar.
  • Build-Metadaten listen 1 Build-Abhängigkeiten.

Empfohlene Prüfung

Prüfe vor unbeaufsichtigter Agent-Nutzung, ob das Tool Klartext-Credentials liest, Remote-Zustand schreibt, Artefakte veröffentlicht oder Plugins ausführt.

Executables

Installierte Executables

BefehlArtSichtbarkeitHinweis
kubesealcliglobales Executable

Aktualität

Version und Aktualität

Diese Signale trennen das Alter der Seitengenerierung, Aktivität des Paketmanagers und Upstream-Release-Vergleich. Versionsrückstand wird nur gemeldet, wenn eine Evidenz-URL und vergleichbare Versionen vorhanden sind.

Seite generiert2026-07-25
Manager-Version0.38.4
Manager aktualisiert2026-07-04
lokale DatenOK
Upstreamnot checked
neueste erkannte Versionnicht erkannt

https://github.com/bitnami/sealed-secrets

Installationsmetadaten

Paketmetadaten

Paketschlüsselbrew:kubeseal
Version0.38.4
PaketmanagerHomebrew
Paketmanager-Seitehttps://formulae.brew.sh/formula/kubeseal
Homepagehttps://github.com/bitnami/sealed-secrets
Repositoryhttps://github.com/bitnami/sealed-secrets
Upstream-Dokumentationhttps://github.com/bitnami-labs/sealed-secrets/blob/main/README.md
LizenzApache-2.0
Quellarchivhttps://github.com/bitnami/sealed-secrets.git
Zuletzt aktualisiert2026-07-04T16:53:43+09:00
Pulseupdated
Build-Abhängigkeitengo
Bottleverfügbar (auf arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnicht definiert
Dienstkeiner deklariert

Registry-Fakten

Details aus der Quelldatenbank

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namekubeseal
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

Source-Datenbank-Treffer

Andere Paketmanager-Einträge

Treffer stammen aus externen Paketmanager-Indizes und bleiben von lokalen Automic-Vault-Paketlinks getrennt.

Nix95%

kubeseal

nix profile install nixpkgs#kubeseal
  • normalized package name match
  • Abgeglichen nach: Kubeseal
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/ku/kubeseal/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
apk95%

kubeseal 0.37.0-r0

A Kubernetes controller and tool for one-way encrypted Secrets

https://github.com/bitnami-labs/sealed-secrets

sudo apk add kubeseal
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: kubeseal
  • 1 Abhängigkeiten
  • 1 stellt bereit
  • normalized package name match
  • Abgeglichen nach: Kubeseal
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: kubeseal from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
apk95%

kubeseal-doc 0.37.0-r0

A Kubernetes controller and tool for one-way encrypted Secrets (documentation)

https://github.com/bitnami-labs/sealed-secrets

sudo apk add kubeseal-doc
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: kubeseal
  • normalized package name match
  • Abgeglichen nach: Kubeseal
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: kubeseal-doc from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
pacman95%

kubeseal 0.35.0-2

A Kubernetes controller and tool for one-way encrypted Secrets

https://github.com/bitnami-labs/sealed-secrets

sudo pacman -S kubeseal
  • License: Apache
  • Architecture: x86_64
  • 1 Abhängigkeiten
  • normalized package name match
  • Abgeglichen nach: Kubeseal
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: kubeseal from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz
zypper95%

kubeseal 0.37.0-1.1

CLI for encrypting secrets to SealedSecrets

https://github.com/bitnami-labs/sealed-secrets

sudo zypper install kubeseal
  • License: Apache-2.0
  • Category: Unspecified
  • Architecture: x86_64
  • Source Package: kubeseal
  • 1 Abhängigkeiten
  • 1 stellt bereit
  • normalized package name match
  • Abgeglichen nach: Kubeseal
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: kubeseal from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
MacPorts95%

kubeseal

sudo port install kubeseal
  • normalized package name match
  • Abgeglichen nach: Kubeseal
MacPorts ports tree · api.github.com · MacPorts ports tree: sysutils/kubeseal/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
Scoop95%

main/kubeseal

scoop install main/kubeseal
  • normalized package name match
  • Abgeglichen nach: Kubeseal
Scoop official bucket manifest trees · api.github.com · Scoop official bucket manifest trees: bucket/kubeseal.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

Paketgraph

Links stammen aus dem lokalen Paketbeziehungsgraph, Ergänzungen, Abhängigkeitskanten, Ecosystem-Matches und Paket-Hub-Mitgliedschaft.

Verwandte Tools

  • goBuild dependency declared by Homebrew.

Gleicher Workflow

  • ksopsShares av.db curated category or tags: cli, kubernetes, secrets, security.
  • kube-benchShares av.db curated category or tags: cli, kubernetes, security.
  • kubehoundShares av.db curated category or tags: cli, kubernetes, security.
  • kubescapeShares av.db curated category or tags: cli, kubernetes, security.
  • blackboxShares av.db curated category or tags: cli, encryption, secrets, security.
  • envioShares av.db curated category or tags: cli, encryption, secrets, security.

Quellspur

Aus Repository-Daten generiert

Diese Seite wird von av-web aus dem privaten Paket-SQLite-Artefakt bereitgestellt, das scripts/generate-pkg-sqlite.py erstellt.

Verwendete Quellen

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated agent safety answer
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment