This content originally appeared on DEV Community and was authored by Dinesh Reddy
🚀 Automating Kubernetes Sealed Secrets Management with Jenkins in a Multi-Cloud Environment
🗒️ Introduction
Managing sensitive data like API keys, passwords, and certificates securely in Kubernetes can be challenging—especially in enterprise environments with multiple clusters. In this guide, we'll explore how to automate Kubernetes Sealed Secrets management using Jenkins, ensuring security, scalability, and efficiency across multi-cloud environments such as AKS, GKE, and EKS.
🛡️ Background
In enterprise environments, sensitive information like API keys, passwords, and certificates must be managed securely. Kubernetes, widely used for container orchestration, stores such data as secrets. However, plain-text Kubernetes secrets are not safe for version control systems or manual handling.
To address this, Sealed Secrets encrypt sensitive data so it can be safely stored and shared. Deploying and managing these Sealed Secrets efficiently in Amazon AKS requires automation to ensure security, scalability, and ease of use.
⚠️ The Challenge
Enterprises often face several challenges:
- Security Risks: Storing secrets in plain text makes them vulnerable to unauthorized access.
- Manual Errors: Manual handling increases the risk of mistakes.
- Complex Management: Managing secrets across environments (dev, staging, prod) is time-consuming.
- Lack of Automation: Kubernetes lacks built-in automation for secret encryption and deployment.
💡 The Solution: Jenkins + Docker-in-Docker (DIND)
A Jenkins pipeline, combined with a Docker-in-Docker (DIND) container, automates the secure management of Sealed Secrets in AKS clusters. Key features include:
- 🔐 Strong Encryption: Uses the Sealed Secrets Controller, ensuring only the AKS cluster can decrypt data.
- 📦 Centralized Management: Jenkins standardizes secret generation and deployment across environments.
- 🛡️ Security Compliance: Secrets are encrypted before storage to meet strict security standards.
- 🔑 RBAC Integration: Kubernetes Role-Based Access Control (RBAC) adds an extra layer of security.
🔗 Check the GitHub Repository for Reference
⚙️ Jenkins Pipeline Workflow
1️⃣ Prepare the Workspace
Set up the environment for processing secrets and generating artifacts:
mkdir -p /tmp/jenkins-k8s-apply
mkdir -p ${WORKSPACE}/sealed-secrets-artifacts
rm -f /tmp/jenkins-k8s-apply/* || true
ls -la /tmp/jenkins-k8s-apply || echo "Directory is empty"
Why? A clean workspace ensures no residual sensitive data remains. ✅
2️⃣ Process Base64 Encoded Secrets
Decode the provided secrets.yaml file:
echo ${SECRETS_YAML} > /tmp/jenkins-k8s-apply/secrets.yaml.b64
base64 --decode < /tmp/jenkins-k8s-apply/secrets.yaml.b64 > /tmp/jenkins-k8s-apply/secrets.yaml
ls -l /tmp/jenkins-k8s-apply/secrets.yaml
head -n 5 /tmp/jenkins-k8s-apply/secrets.yaml | grep -v 'data:' || echo "File appears to be empty"
3️⃣ Apply Kubernetes Config & Fetch Public Certificate
Fetch the Sealed Secrets Controller’s public certificate:
ls -l ${KUBECONFIG} # Validate kubeconfig
docker run --rm \
-v ${KUBECONFIG}:/tmp/kubeconfig \
-v /tmp/jenkins-k8s-apply/secrets.yaml:/tmp/secrets.yaml \
docker-dind-kube-secret kubeseal \
--controller-name=sealed-secrets \
--controller-namespace=kube-system \
--kubeconfig=/tmp/kubeconfig \
--fetch-cert > /tmp/jenkins-k8s-apply/sealed-secrets-cert.pem
ls -l /tmp/jenkins-k8s-apply/sealed-secrets-cert.pem # Validate certificate
4️⃣ Create Sealed Secrets
Encrypt the secrets using the public certificate:
docker run --rm \
-v ${KUBECONFIG}:/tmp/kubeconfig \
-v /tmp/jenkins-k8s-apply/secrets.yaml:/tmp/secrets.yaml \
-v /tmp/jenkins-k8s-apply/sealed-secrets-cert.pem:/tmp/sealed-secrets-cert.pem \
docker-dind-kube-secret sh -c "kubeseal \
--controller-name=sealed-secrets \
--controller-namespace=kube-system \
--format yaml \
--cert /tmp/sealed-secrets-cert.pem \
--namespace=${NAMESPACE} \
< /tmp/secrets.yaml" > ${WORKSPACE}/sealed-secrets-artifacts/sealed-secrets.yaml
5️⃣ Generate Documentation
Create metadata to track secret deployments:
echo "Generated on: $(date)" > ${WORKSPACE}/sealed-secrets-artifacts/README.txt
echo "Namespace: ${NAMESPACE}" >> ${WORKSPACE}/sealed-secrets-artifacts/README.txt
echo "Controller: sealed-secrets" >> ${WORKSPACE}/sealed-secrets-artifacts/README.txt
echo "Controller Namespace: kube-system" >> ${WORKSPACE}/sealed-secrets-artifacts/README.txt
🎯 Key Benefits
- 🔒 Enhanced Security: Encryption before storage mitigates the risk of data leaks.
- ⚡ Automation: Reduces manual effort, ensuring consistent workflows.
- 🌍 Scalability: Easily handles multiple environments and clusters.
- ✅ Compliance: Simplifies regulatory audits with secure secret management.
Seamlessly integrates with existing CI/CD workflows and AWS services—perfect for scaling across clusters. 🚀
📦 Part 2: Automating Kubernetes Sealed Secrets in Multi-Cloud Environments
In Part 2, we’ll expand this approach to multi-cloud environments, covering:
- AKS (Non-Production) ✅
- GKE (Production Cluster 1) ☁️
- EKS (Production Cluster 2) 🛡️
Stay tuned for advanced multi-cloud secret management techniques! 💼
This content originally appeared on DEV Community and was authored by Dinesh Reddy
Dinesh Reddy | Sciencx (2025-02-05T02:00:11+00:00) Automating Kubernetes Sealed Secrets Management with Jenkins in a Multi-Cloud Environment -Part1. Retrieved from https://www.scien.cx/2025/02/05/automating-kubernetes-sealed-secrets-management-with-jenkins-in-a-multi-cloud-environment-part1/
Please log in to upload a file.
There are no updates yet.
Click the Upload button above to add an update.