Credential access
Handles secret manifests and cluster public keys; input files may contain sensitive values.
brew
Install kubeseal with Homebrew, apk, MacPorts, Nix, pacman, scoop, zypper
Kubernetes controller and tool for one-way encrypted Secrets. Version 0.38.4 via Homebrew; verified 2026-07-04.
agent safety
Agent safety answer
kubeseal transforms Kubernetes secrets and is tied to cluster secret-management workflows.
Remote mutation
Does not usually mutate clusters directly, but output is intended for cluster application.
Publish/artifact risk
Can produce sealed secret artifacts committed or deployed to clusters.
Recommended control
Gate commands that read plaintext secret files or write deployable sealed secrets.
Agent-use guidance
Allow public-key fetches; require approval before processing plaintext secrets or writing manifests.
install
Additional install commands
macOS
Homebrewverified · 100%
brew install kubeseallocal Homebrew formula metadata
MacPortsverified · 94%
sudo port install kubesealMacPorts ports tree · sysutils/kubeseal/Portfile · source: api.github.com
Linux
Alpine Linux apkverified · 92%
sudo apk add kubesealAlpine Linux edge package indexes · kubeseal · source: dl-cdn.alpinelinux.org
Nixverified · 92%
nix profile install nixpkgs#kubesealnixpkgs package indexes · pkgs/by-name/ku/kubeseal/package.nix · source: api.github.com
Arch Linux pacmanverified · 92%
sudo pacman -S kubesealArch Linux sync databases · kubeseal · source: geo.mirror.pkgbuild.com
openSUSE zypperverified · 92%
sudo zypper install kubesealopenSUSE Tumbleweed package metadata · kubeseal · source: download.opensuse.org
Windows
Scoopverified · 92%
scoop install main/kubesealScoop official bucket manifest trees · bucket/kubeseal.json · source: api.github.com
overview
Package summary
Kubernetes controller and tool for one-way encrypted Secrets
Project links
Commands and aliases
- kubeseal
history
Project history and usage
kubeseal is the client-side utility for Bitnami Sealed Secrets, a Kubernetes controller and custom resource pattern for storing encrypted Secrets safely in Git.
Project history
Sealed Secrets addresses the GitOps-era problem of managing Kubernetes configuration in version control while keeping Secret values encrypted. The project is split into a cluster-side controller/operator and the kubeseal CLI. kubeseal uses asymmetric cryptography to encrypt a Kubernetes Secret into a SealedSecret custom resource that only the target cluster's controller can decrypt.
Adoption history
kubeseal became a common companion tool for teams that wanted declarative Kubernetes deployments without introducing an external secret store into every workflow. Its release notes and README document distribution through Homebrew, MacPorts, Nixpkgs, Linux binaries, and controller manifests.
How it is used
A typical workflow creates or exports a Kubernetes Secret manifest, pipes it through kubeseal, commits the resulting SealedSecret YAML, and lets the in-cluster controller unseal it back into a normal Kubernetes Secret.
Why package nerds care
kubeseal is package-nerd interesting because the CLI is only half of the product: the packaged binary must line up with a CRD/controller deployed in the cluster. It also turned a security-sensitive Kubernetes workflow into a small Unix-friendly command-line transform.
Timeline
- 2026: The v0.38.1 release page listed controller installation YAML and kubeseal client binaries, including Homebrew instructions for macOS.
Related projects
- Related tools and patterns include Kubernetes Secrets, GitOps controllers such as Argo CD and Flux, external-secrets operators, SOPS, and cloud KMS-backed secret-management workflows.
Sources
security posture
Risk level: orange
broad file, network, media, or database tool signal. infrastructure mutation or orchestration signal.
Risk classifier
orange risk · medium confidence · infrastructure
Why
- broad file, network, media, or database tool signal
- infrastructure mutation or orchestration signal
Signals
- text:encrypt
- text:kubernetes
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 6 platform targets.
- Build metadata lists 1 build dependencies.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
kubeseal | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version0.38.4
manager updated2026-07-04
local dataok
upstreamnot checked
latest detectednot detected
https://github.com/bitnami/sealed-secrets
- infoNo cached GitHub release or tag data was available.https://github.com/bitnami/sealed-secretsnone confidence
install metadata
Package metadata
| Package key | brew:kubeseal |
|---|---|
| Version | 0.38.4 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/kubeseal |
| Homepage | https://github.com/bitnami/sealed-secrets |
| Repository | https://github.com/bitnami/sealed-secrets |
| Upstream docs | https://github.com/bitnami-labs/sealed-secrets/blob/main/README.md |
| License | Apache-2.0 |
| Source archive | https://github.com/bitnami/sealed-secrets.git |
| Last updated | 2026-07-04T16:53:43+09:00 |
| Pulse | updated |
| Build dependencies | go |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | kubeseal |
| Version Scheme | 0 |
| Revision | 0 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Nix95%
kubeseal
nix profile install nixpkgs#kubeseal- normalized package name match
- Matched by: Kubeseal
apk95%
kubeseal 0.37.0-r0
A Kubernetes controller and tool for one-way encrypted Secrets
https://github.com/bitnami-labs/sealed-secrets
sudo apk add kubeseal- License: Apache-2.0
- Architecture: x86_64
- Source Package: kubeseal
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Kubeseal
apk95%
kubeseal-doc 0.37.0-r0
A Kubernetes controller and tool for one-way encrypted Secrets (documentation)
https://github.com/bitnami-labs/sealed-secrets
sudo apk add kubeseal-doc- License: Apache-2.0
- Architecture: x86_64
- Source Package: kubeseal
- normalized package name match
- Matched by: Kubeseal
pacman95%
kubeseal 0.35.0-2
A Kubernetes controller and tool for one-way encrypted Secrets
https://github.com/bitnami-labs/sealed-secrets
sudo pacman -S kubeseal- License: Apache
- Architecture: x86_64
- 1 dependencies
- normalized package name match
- Matched by: Kubeseal
zypper95%
kubeseal 0.37.0-1.1
CLI for encrypting secrets to SealedSecrets
https://github.com/bitnami-labs/sealed-secrets
sudo zypper install kubeseal- License: Apache-2.0
- Category: Unspecified
- Architecture: x86_64
- Source Package: kubeseal
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Kubeseal
MacPorts95%
kubeseal
sudo port install kubeseal- normalized package name match
- Matched by: Kubeseal
Scoop95%
main/kubeseal
scoop install main/kubeseal- normalized package name match
- Matched by: Kubeseal
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated agent safety answer
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment