For Jenkins to deploy a SealedSecret to multiple Kubernetes clusters, each destination cluster needs a Sealed Secrets controller, and Jenkins needs an explicitly selected cluster identity with narrowly scoped permissions. Use a different sealing key for each independent trust boundary; share a key only when applying the same ciphertext to chosen clusters is an intentional design decision. Jenkins transports and applies the encrypted manifest—the controller in the destination cluster unseals it and creates the Kubernetes Secret.
How the pieces fit together
Sealed Secrets has three parts: a SealedSecret custom resource, the kubeseal client, and a controller running in Kubernetes. The client seals a Secret for a controller’s public key. The controller holds the corresponding private key and reconciles a matching SealedSecret into an ordinary Kubernetes Secret.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
The Kubernetes Book | $58.50 | Buy on Amazon |
| 2 |
|
The Kubernetes Book | $26.63 | Buy on Amazon |
| 3 |
|
The Kubernetes Book: Starfleet Edition | $58.99 | Buy on Amazon |
| 4 |
|
The Kubernetes Book: Klingon edition | $58.40 | Buy on Amazon |
| 5 |
|
The Absolutely True Diary of a Part-Time Indian (National Book Award Winner) | $9.81 | Buy on Amazon |
In a multi-cluster setup, install and operate a controller in every target cluster. Store encrypted SealedSecret manifests in source control, then have Jenkins choose a destination cluster, validate and apply the manifest, and wait for reconciliation before proceeding with the workload deployment. Jenkins does not perform the unsealing: that happens inside the cluster where the controller runs.
Choose a sealing-key strategy
The key decision is whether clusters should be separate trust domains or should accept the same ciphertext. Bitnami documents that selected clusters can share a sealing key when operators need to apply the same SealedSecret in each one. Sharing that key also makes those clusters part of a common decryption trust domain. The blast-radius comparison below is an operational implication of that documented behavior.
Recommended Free Tools
#1 Best Overall
| Design | Isolation | Promotion | Operational implication |
|---|---|---|---|
| Separate key per cluster or trust boundary | Each controller has its own key; a compromise in one cluster does not, by that key alone, expose ciphertext sealed for another. | Seal separately for each destination, or add a re-encryption step when promoting between clusters. | Track and back up each cluster’s private key material; plan rotation and recovery for each trust boundary. |
| Shared key for selected clusters | Those clusters share a decryption trust domain. A cluster with access to the shared private key can decrypt ciphertext intended for that key. | The same ciphertext can be applied to the selected clusters. | Restrict which clusters receive the key and protect its backup accordingly. |
Prefer separate keys when clusters have different owners, environments, tenants, or compliance boundaries. Treat shared-key use as a deliberate exception for clusters whose operators and security controls are trusted to the same standard.
Account for controller scope
Key separation is not the only control. The controller’s namespace watch behavior affects which SealedSecrets it handles. By default, the controller watches across namespaces; operators can configure specific namespaces or local-only operation. Use the narrowest scope that suits the cluster’s tenancy and ownership model.
Rank #2
Build the Jenkins promotion path
Keep the encrypted manifests in the repository and make the destination explicit in the pipeline. The precise Jenkinsfile and authentication steps depend on the agent image, Kubernetes authentication method, and deployment tool, so treat the sequence below as a design rather than copy-and-paste syntax.
- Prepare the manifest. Seal the source Secret for the intended controller and scope. Store the resulting SealedSecret YAML—not the plaintext Secret—in source control.
- Validate before deployment. Run schema, policy, and manifest checks before any apply operation. Confirm that the manifest is intended for the selected cluster and namespace.
- Select the destination. Use an explicit cluster context or equivalent destination selection. Avoid relying on an agent’s implicit default context.
- Authenticate with least privilege. Give Jenkins an identity restricted to the required namespace and resources. Store kubeconfigs, tokens, or other credentials in Jenkins credentials with the narrowest practical folder or item scope.
- Apply the SealedSecret. Send the encrypted manifest to the selected cluster. The cluster-side controller must be installed and able to reconcile the resource.
- Wait for reconciliation. Gate the workload deployment on successful creation or update of the ordinary Kubernetes Secret. Define a failure path rather than treating a successful apply request alone as proof that the Secret is ready.
- Deploy the workload. Proceed only after the secret-reconciliation check succeeds. Do not print secret values or publish them in build artifacts.
Jenkins warns that credentials defined at controller scope are available to every Pipeline run by that controller. Prefer narrower credential scopes and limit who can create or use them.
How the resulting Secret reaches Jenkins or an application
The SealedSecret’s template section controls metadata and type on the Kubernetes Secret the controller creates. The Sealed Secrets README includes Jenkins credential labels and annotations as an example of metadata that can be carried through that template. The encrypted manifest remains the version-controlled representation; the unsealed Kubernetes Secret exists in the cluster.
That does not automatically turn a Kubernetes Secret into a Jenkins credential. If a workload in the cluster needs the value, configure that workload to consume the Kubernetes Secret using its normal Kubernetes integration. If Jenkins itself needs the value, define and document a separate, appropriately secured integration or retrieval path. Keep access narrow and prevent values from appearing in console output, test reports, or archived artifacts.
Protect Jenkins credentials and key material
Jenkins credentials are encrypted at rest, with key material held under $JENKINS_HOME/secrets. That makes access to the Jenkins host and its backups security-critical: a party who can obtain both the credential data and the required key material may be able to recover credentials. Restrict filesystem and backup access, and include restoration procedures in operational recovery plans.
Sealed Secrets private keys are a separate recovery concern. Back them up separately from Jenkins credentials, restrict backup access, and test restoration. Without the private key used for a ciphertext, operators cannot recover its original Secret from that SealedSecret; they must regenerate the credential and seal it again.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesBest Value
Plan rotation, retirement, and recovery
Controller key rotation
The controller generates and rotates sealing keys. Bitnami describes a 30-day renewal as a reasonable default that can be adjusted. Treat that as a configurable default, not a guarantee that every installation has the same rotation schedule. Confirm the deployed controller’s configuration and preserve the private keys needed to decrypt existing SealedSecrets.
Cluster retirement or trust-boundary changes
If a cluster leaves a shared-key group, decide how existing manifests will remain deployable. Options include retaining the shared key under controlled access for existing ciphertext, or moving to a new trust boundary by sealing manifests with the relevant new key. Make this a planned migration: changing which key a controller has does not by itself rewrite ciphertext already stored in Git.
Recovery rehearsal
- Verify that private-key backups are accessible to the authorized recovery operators, but not broadly available to build jobs or developers.
- Test restoration in a controlled environment and confirm that previously sealed manifests can be reconciled.
- Document the response if a key is lost: identify affected ciphertext, regenerate the underlying credentials where necessary, and reseal for the intended controller.
- Keep Jenkins’ own credential-encryption recovery material and Sealed Secrets keys under separate access and backup controls.
Installation and compatibility checks
The official Sealed Secrets project supports installation by manifest and Helm. The chart and kubeseal CLI can have different default controller names, so specify the controller name and namespace explicitly when defaults do not match the installed controller. Before rollout, verify the Kubernetes, controller, Helm chart, and kubeseal versions used by each cluster; compatibility changes with releases, and no single version combination is specified here.
Quick Recap
Design decisions to make before rollout
- Trust boundaries: decide which clusters, if any, are allowed to share a sealing key.
- Controller scope: set namespace watching to match the cluster’s isolation and tenancy requirements.
- Promotion ownership: choose whether Jenkins, a GitOps controller, or another deployment system applies manifests and checks readiness.
- Credential scope: assign Jenkins identities only the permissions required for their target namespaces and resources.
- Recovery: back up and rehearse restoration for both controller private keys and Jenkins encryption material.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
