📄 YAMLmedium

3. A SealedSecret (safe to commit)

Write a Bitnami SealedSecret — encrypted so it is SAFE to commit to Git: • apiVersion: bitnami.com/v1alpha1 • kind: SealedSecret • metadata.name: db-creds, metadata.namespace: default • spec.encryptedData.password: AgByth3ci ph3rt3xt== (any ciphertext string) • spec.template.metadata.name: db-creds

How to approach this

Sealed Secrets solve 'you can't commit a raw Secret.' You encrypt with the controller's PUBLIC key (via `kubeseal`); only the in-cluster controller holds the private key, so the ciphertext under `spec.encryptedData` is safe in Git. The controller decrypts it into a normal Secret named by `spec.template.metadata.name`. Encryption is bound to name+namespace so the blob can't be moved elsewhere.

config.yaml