<p>I have a question in regards to using <a href="https://github.com/bitnami-labs/sealed-secrets" rel="nofollow noreferrer">sealed-secrets
</a>.</p>
<p>SealedSecrets solution solves the issue we’ve got: be able to store secrets in our version control. However, we want to be able to re-generate the plain secret file from a sealed-secret file (an already encrypted file by kubeseal). Usecase: you go to an existing repo, clone it and you want to see what are the actual secret values from your local machine.</p>
<ul>
<li>Is it possible to accomplish this with kubeseal?</li>
<li>If not, how do you recommend to achieve such behaviour? Maybe an integration with a cloud secret manager, for instance?</li>
</ul>
<p>As I understand, it goes against the purpose of sealed secrets, given that I want to decrypt outside of the kubernetes controller. But I hope that the use-case makes sense and I get some recommendations on how to achieve that.</p>

Miquel puig mena
<p>Yes, you can only decrypt by downloading sealed-secrets-key. So you can do same as controller does. You have to have access to namespace where Sealed Secrets is installed.</p>
<p>Just check if <code>kubectl pods</code> or <code>kubectl nodes</code> show resources on right cluster and:</p>
<pre><code>kubectl get secret -n sealed-secrets -l sealedsecrets.bitnami.com/sealed-secrets-key -o yaml &gt; sealed-secrets-key.yaml

kubeseal --controller-name=sealed-secrets --controller-namespace=sealed-secrets &lt; /tmp/sealed-secret.yaml --recovery-unseal --recovery-private-key sealed-secrets-key.yaml -o yaml

</code></pre>
<p><code>/tmp/sealed-secret.yaml</code> is your file that is in version control system. You can also find any sealed secret at: <code>kubectl get sealedsecrets -A</code> and pass it.</p>
<p>Reference:</p>
<p><a href="https://github.com/bitnami-labs/sealed-secrets#will-you-still-be-able-to-decrypt-if-you-no-longer-have-access-to-your-cluster" rel="nofollow noreferrer">https://github.com/bitnami-labs/sealed-secrets#will-you-still-be-able-to-decrypt-if-you-no-longer-have-access-to-your-cluster</a></p>
