App Dev

Sekret: Encryption tool for Kubernetes Secrets

Shogo Watanabe
Feature image

Sekret is a CLI tool to encrypt and edit Kubernetes Secrets. Sekret makes management and deployment for Secret secure and simple.






You can get Sekret with go get.

Terminal window
go get

Also, you can download binaries from GitHub Releases.

Terminal window
curl -sSL -o /path/to/sekret
chmod +x /path/to/sekret


sekret command is used following subcommands enc / dec / new / edit.

Terminal window
sekret subcommand [options] filename

The environment variable ENCRYPTION_KEY is used as the encryption key for all subcommands. Encryption keys must be 16 or 32 bytes. EDITOR variable specifies the editor for new and edit subcommands. Command options can also specify them.


Following commands encrypt secret.yaml and then commit it on Git.

Terminal window
$ export ENCRYPTION_KEY=$(cat /dev/urandom | base64 | fold -32 | head -1)
$ sekret enc secret.yaml > secret.yaml.enc
$ git add secret.yaml.enc
$ git commit


Easy to decrypt and apply Secrets.

Terminal window
$ sekret dec secret.yaml.enc | kubectl apply -f -

Create New Encrypted Secrets

new subcommand creates a new encrypted Secret YAMLs.

Terminal window
$ export EDITOR=vim
$ sekret new secret.yaml.enc

sekret new opens specified editor with the Secret template like following YAML.

apiVersion: v1
Key: Value
kind: Secret
creationTimestamp: null
name: new-secret
type: Opaque

Values of data must be encoded as base64 in Kubernetes Secrets, but sekret encodes and decodes automatically on opening and saving them. So you can write YAML as completely plain text. If you want to edit as base64, use --decode-base64=false option.

Sekret validates before saving YAML, so it doesn’t save YAML when invalid.

Edit Encrypted Secrets

You can edit encrypted Secret YAML like plaintexts with edit subcommand.

Terminal window
$ sekret edit secret.yaml.enc

sekret edit opens decrypted and base64 decoded YAML in the specified editor. When the editor is closed, it saves encrypted and base64 encoded YAML. Of course, it validates YAML before saving.


Sekret makes lifecycle of Sekret very simple and secure. It is effortless to manage and deploy Secret YAML.

← Back to Blog