kseal 0.1.0

A kubeseal companion CLI - decrypt, export, and encrypt Kubernetes SealedSecrets with automatic binary management

kseal

A kubeseal companion CLI for viewing, exporting, and encrypting Kubernetes SealedSecrets.

Installation

pipx install kseal

Other installation methods

With uv:

uv tool install kseal

With pip:

pip install kseal

Requirements

• Python 3.12+
• Kubernetes cluster access
• Sealed Secrets controller installed in cluster

Quick Start

# View a decrypted secret
kseal cat secrets/app.yaml

# Export all secrets to files
kseal export --all

# Encrypt a plaintext secret
kseal encrypt secret.yaml -o sealed.yaml

Commands

kseal cat

View decrypted secret contents with syntax highlighting.

kseal cat path/to/sealed-secret.yaml
kseal cat sealed.yaml --no-color

kseal export

Export decrypted secrets to files.

# Single file
kseal export sealed.yaml
kseal export sealed.yaml -o output.yaml

# All local SealedSecrets
kseal export --all

# All secrets from cluster
kseal export --all --from-cluster

Default output: .unsealed/<original-path> or .unsealed/<namespace>/<name>.yaml

kseal encrypt

Encrypt plaintext secrets using kubeseal.

# To stdout
kseal encrypt secret.yaml

# To file
kseal encrypt secret.yaml -o sealed.yaml

# Replace original
kseal encrypt secret.yaml --replace

kseal init

Create a configuration file.

kseal init
kseal init --force  # Overwrite existing

Configuration

Configuration priority: Environment variables > .kseal-config.yaml > Defaults

Option	Environment Variable	Default
kubeseal_path	KSEAL_KUBESEAL_PATH	~/.local/share/kseal/kubeseal
version	KSEAL_VERSION	latest
controller_name	KSEAL_CONTROLLER_NAME	sealed-secrets
controller_namespace	KSEAL_CONTROLLER_NAMESPACE	sealed-secrets
unsealed_dir	KSEAL_UNSEALED_DIR	.unsealed

Example config file

# .kseal-config.yaml
kubeseal_path: /usr/local/bin/kubeseal
version: "0.27.0"
controller_name: sealed-secrets
controller_namespace: kube-system
unsealed_dir: .secrets

Security

• Add .unsealed/ to your .gitignore
• Never commit plaintext secrets to version control
• Requires cluster access to decrypt secrets

Contributing

git clone https://github.com/eznix86/kseal.git
cd kseal
uv sync

# Run tests
make test

# Run linter
make lint

License

MIT