Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Oct 16, 2026

Utilities

Encrypt a Kubernetes Secret with a public certificate

kubeseal-offline is an offline Kubernetes Secret encryption node powered by kubeseal in strict scope.

Agent
Prepare a sealed manifestBind encryption to a namespaceRecord encryption metadata

overview

What kubeseal-offline does

Supply secret.json and certificate.pem in one folder. Native kubeseal returns a SealedSecret in strict scope, bound to the explicit Secret name and namespace, alongside a report without plaintext input values. The certificate must belong to the controller you intend to use.

Only v1 Opaque Secrets with 1 to 16 disjoint data/stringData keys are accepted. Limits are 32 KiB decoded values, 64 KiB Secret JSON, a 16 KiB single RSA public certificate of at least 2048 bits and a 20-second native timeout. Private keys, annotations and unknown fields are refused.

Input or native processing failures fail the operation. The operation keeps the supplied source unchanged.

This operation uses 0.40.0. Upstream license: Apache-2.0. The source link identifies the program used by this node.

source github.com/bitnami-labs/sealed-secrets/tree/v0.40.0

use cases

Where kubeseal-offline fits

Prepare a sealed manifest

Encrypt a supplied Opaque Secret with the intended controller public certificate.

Bind encryption to a namespace

Keep strict name and namespace binding in the returned SealedSecret.

Record encryption metadata

Retain key names, scope and output hash without writing plaintext values into the report.

reference

kubeseal-offline inputs and flags

1 inputs
NameTypeFlagDescription
sourceFOLDER--sourceFolder containing exactly secret.json (v1 Opaque Secret, explicit name/namespace only, data or stringData, 1-16 disjoint keys, 32KiB decoded total, 64KiB JSON) and certificate.pem (single RSA public certificate, at least 2048bits, 16KiB). Fixed strict name/namespace binding, JSON output, 20s native timeout. No URLs, kubeconfig, private keys, cluster requests, validation against live controller, remote updates or arbitrary flags. Linux amd64.

Showing key inputs. kubeseal-offline exposes 1 inputs in total.

example

Run kubeseal-offline

kubeseal-offline · command
python3 /app/run.py --source ./source ./output
sample output
{
  "tool": "kubeseal-offline",
  "native_version": "0.40.0",
  "native_exit_code": 0,
  "scope": "strict",
  "cluster_access": false,
  "encrypted_keys": [
    "binary",
    "message"
  ],
  "entry_count": 2,
  "name": "synthetic-smoke",
  "namespace": "fixture"
}

guidance

Choosing kubeseal-offline

Use offline sealing when you already have the correct public controller certificate. This operation neither contacts a controller nor proves that the certificate belongs to a trusted cluster.

Kubernetes Secret

Contains encoded values; a SealedSecret encrypts values against the supplied sealing certificate.

faq

kubeseal-offline questions

source: Folder containing exactly secret.json (v1 Opaque Secret, explicit name/namespace only, data or stringData, 1-16 disjoint keys, 32KiB decoded total, 64KiB JSON) and certificate.pem (single RSA public certificate, at least 2048bits, 16KiB). Fixed strict name/namespace binding, JSON output, 20s native timeout. No URLs, kubeconfig, private keys, cluster requests, validation against live controller, remote updates or arbitrary flags. Linux amd64.

SealedSecret and report. Native processing must succeed before an output artifact is returned.

Only v1 Opaque Secrets with 1 to 16 disjoint data/stringData keys are accepted. Limits are 32 KiB decoded values, 64 KiB Secret JSON, a 16 KiB single RSA public certificate of at least 2048 bits and a 20-second native timeout. Private keys, annotations and unknown fields are refused.

Use offline sealing when you already have the correct public controller certificate. This operation neither contacts a controller nor proves that the certificate belongs to a trusted cluster.

The image repository also contains a digest-bound source/notices artifact. Download it with oras pull docker.io/nenadzaric/skills-intel-kubeseal-offline@sha256:b1d4187252ed13e57acc409aa50953c5d9f3273065aefae9a69ed433e6912668. The bundle includes the build recipe, licenses, copied notices and component-source directions. Bundle SHA256: 3507db7d71cf7eaa0077b5904d6ea4942a22e6a05f8a7277ac095cf7579ee8e2. Follow its source directions for upstream archives and patches. Image and source/notices repository.

related

More Utilities tools

  1. browser-fetch

    Headless Chromium render: requested URL, final URL, status, and title next to the page.

  2. cewl

    Spider a URL and return a wordlist for password crackers.

  3. csvkit

    SQL on one CSV. The table name is the file stem.

  4. dnsgen

    Wordlist and mined-word subdomain permutation.

  5. duckdb

    In-process SQL on CSV, JSON, and Parquet. No server.

  6. edge-tts

    Microsoft Edge neural speech from text or a script file. No API key.

Run kubeseal-offline yourself

The synthetic run checks sealedsecret and report. The excerpt shows selected native fields asserted by saved passing platform verifier; reconstructed excerpt, not full raw artifact. The command shown is the container entrypoint with example paths, not a host-installed CLI command.

Open kubeseal-offline in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.