{"id":21971353,"url":"https://github.com/bakito/sealed-secrets-web","last_synced_at":"2026-03-04T01:24:20.873Z","repository":{"id":36973797,"uuid":"399006168","full_name":"bakito/sealed-secrets-web","owner":"bakito","description":"A web interface for Sealed Secrets by Bitnami.","archived":false,"fork":false,"pushed_at":"2025-03-24T06:39:23.000Z","size":6737,"stargazers_count":119,"open_issues_count":0,"forks_count":21,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-03-28T00:42:33.744Z","etag":null,"topics":["encrypt-secrets","kubernetes","kubernetes-secrets"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"ricoberger/sealed-secrets-web","license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bakito.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":["bakito"]}},"created_at":"2021-08-23T07:07:07.000Z","updated_at":"2025-03-24T15:13:15.000Z","dependencies_parsed_at":"2024-01-29T08:58:45.597Z","dependency_job_id":"69f6d569-9040-4e55-b08b-9e01c779415e","html_url":"https://github.com/bakito/sealed-secrets-web","commit_stats":{"total_commits":337,"total_committers":14,"mean_commits":"24.071428571428573","dds":0.5608308605341246,"last_synced_commit":"2eb39b25f0c77ed20b59256596f4abfd963c65e9"},"previous_names":[],"tags_count":45,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bakito%2Fsealed-secrets-web","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bakito%2Fsealed-secrets-web/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bakito%2Fsealed-secrets-web/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bakito%2Fsealed-secrets-web/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bakito","download_url":"https://codeload.github.com/bakito/sealed-secrets-web/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247190257,"owners_count":20898702,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["encrypt-secrets","kubernetes","kubernetes-secrets"],"created_at":"2024-11-29T14:50:18.124Z","updated_at":"2026-03-04T01:24:20.865Z","avatar_url":"https://github.com/bakito.png","language":"Go","funding_links":["https://github.com/sponsors/bakito"],"categories":["Go"],"sub_categories":[],"readme":"[![end-2-end Helm Chart Tests](https://github.com/bakito/sealed-secrets-web/actions/workflows/e2e.yaml/badge.svg)](https://github.com/bakito/sealed-secrets-web/actions/workflows/e2e.yaml)\n[![Go Report Card](https://goreportcard.com/badge/github.com/bakito/sealed-secrets-web)](https://goreportcard.com/report/github.com/bakito/sealed-secrets-web)\n[![Coverage Status](https://coveralls.io/repos/github/bakito/sealed-secrets-web/badge.svg?branch=main\u0026service=github)](https://coveralls.io/github/bakito/sealed-secrets-web?branch=main)\n\n\u003cdiv align=\"center\"\u003e\n  \u003cimg src=\"./assets/logo.png\" /\u003e\n  \u003cbr\u003e\u003cbr\u003e\n\nA web interface for [Sealed Secrets](https://github.com/bitnami-labs/sealed-secrets) by Bitnami.\n\n  \u003cimg src=\"./assets/example1.png\" width=\"100%\" /\u003e\n  \u003cimg src=\"./assets/example2.png\" width=\"100%\" /\u003e\n\u003c/div\u003e\n\n**Sealed Secrets Web** is a web interface for [Sealed Secrets](https://github.com/bitnami-labs/sealed-secrets) by\nBitnami. The web interface let you encode, decode the keys in the `data` field of a secret, load existing Sealed Secrets\nand create Sealed Secrets. Under the hood it uses Sealed Secrets service API to encrypt your secrets. The web interface\nshould be installed to your Kubernetes cluster, so your developers do not need access to\nyour cluster via kubectl.\n\n- **Encode:** Base64 encodes each key in the `stringData` field in a secret.\n- **Decode:** Base64 decodes each key in the `data` field in a secret.\n- **Secrets:** Returns a list of all Sealed Secrets in all namespaces. With a click on the Sealed Secret the decrypted\n  Kubernetes secret is loaded.\n- **Seal:** Encrypt a Kubernetes secret and creates the Sealed Secret.\n- **Validate:** Validate a Sealed Secret.\n\n## Installation\n\n**sealed-secrets-web** can be installed via our Helm chart:\n\n```sh\nhelm repo add bakito https://charts.bakito.net\nhelm repo update\n\nhelm upgrade --install sealed-secrets-web bakito/sealed-secrets-web\n```\n\nTo modify the settings for Sealed Secrets you can modify the arguments for the Docker image with the `--set` flag. For\nexample you can set a different `controller-name` during the installation with the following command:\n\n```sh\nhelm upgrade --install sealed-secrets-web bakito/sealed-secrets-web \\\n  --set sealedSecrets.namespace=sealed-secrets \\\n  --set sealedSecrets.serviceName=sealed-secrets\n\n```\n\nor if you want to disable ability to load existing secrets, and use the tool purelly to seal new ones you can use:\n\n```sh\nhelm upgrade --install sealed-secrets-web bakito/sealed-secrets-web \\\n  --set disableLoadSecrets=true\n```\n\nTo render templates locally:\n\n```sh\ncd chart\nhelm template . -f values.yaml\n```\n\nYou can check helm values available at https://github.com/bakito/sealed-secrets-web/blob/main/chart/values.yaml\nAlso, check available application options\nat https://github.com/bakito/sealed-secrets-web/blob/main/pkg/config/types.go#L14-L22\n\n## Api Usage\n\n### Get current certificate\n\n```bash\ncurl --request GET 'https://\u003cSEALED_SECRETS_WEB_BASE_URL\u003e/api/certificate'\n```\n\n### Seal a secret using servers certificate\n\n#### having sealed secret as yaml output\n\n```bash\ncurl --request POST 'https://\u003cSEALED_SECRETS_WEB_BASE_URL\u003e/api/kubeseal' \\\n  --header 'Accept: application/yaml' \\\n  --data-binary '@stringData.yaml'\n```\n\n#### having sealed secret as json output\n\n```bash\ncurl --request POST 'https://\u003cSEALED_SECRETS_WEB_BASE_URL\u003e/api/kubeseal' \\\n  --header 'Accept: application/json' \\\n  --data-binary '@stringData.yaml'\n```\n\n#### sealing one value with default scope\n\n```bash\ncurl -request POST 'https://\u003cSEALED_SECRETS_WEB_BASE_URL\u003e/api/raw' \\\n     --header 'Content-Type: application/json' \\\n     --data '{ \"name\": \"mysecretname\", \"namespace\": \"mysecretnamespace\", \"value\": \"value to seal\" }'\n```\n\n### Validate sealed secret\n\n\u003e **_NOTE:_**  Validate is only available when using cluster internal api (e.g. certURL not set)\n\u003e see [bitnami-labs/sealed-secrets](https://github.com/bitnami-labs/sealed-secrets/issues/1208)\n\n```bash\ncurl --request POST 'https://\u003cSEALED_SECRETS_WEB_BASE_URL\u003e/api/validate' \\\n  --header 'Accept: application/yaml' \\\n  --data-binary '@stringData.yaml'\n```\n\n## Development\n\nFor development, we are using a local Kubernetes cluster using kind. When the cluster is created we install **Sealed\nSecrets** using Helm:\n\n```sh\n./run_local.sh\n```\n\nAccess the interface via http://localhost/ssw\n\n## Traefik\n\nThis section is about using sealed-secrets-web with Traefik ingress controller.\n\nTraefik does not by default strip the path when forwarding to application. If your path is `localhost/seal`, then your route will be parsed by Traefik and your application will be accessed at `/seal`, not `/`.\n\nTo configure Traefik correctly, apply the following resource:\n\n```bash\n$ cat \u003c\u003c EOF \u003e traefik-strip-prefix-middleware.yaml\napiVersion: traefik.containo.us/v1alpha1\nkind: Middleware\nmetadata:\n  name: strip-prefix\n  namespace: kube-system # can be anything, but needs ingress.metadata.annotations spec: traefik.ingress.kubernetes.io/router.middlewares: namespace-strip-prefix@kubernetescrd\nspec:\n  stripPrefixRegex:\n    regex:\n    - ^/[^/]+\nEOF\n\n$ kubectl apply -f traefik-strip-prefix-middleware.yaml\n```\n\nNext, in your `values.yaml`, adapt the following to your host:\n\n```yaml\ningress:\n  enabled: true\n  className: traefik\n  hosts:\n  - host: your.host\n    paths:\n    - path: /seal\n      pathType: ImplementationSpecific\n  annotations:\n    traefik.ingress.kubernetes.io/router.middlewares: kube-system-strip-prefix@kubernetescrd\n\nsealedSecrets:\n  certURL: https://your.host/v1/cert.pem\n\nwebLogs: true\nwebContext: /seal\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbakito%2Fsealed-secrets-web","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbakito%2Fsealed-secrets-web","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbakito%2Fsealed-secrets-web/lists"}