Alternatives to Sealed Secrets
A Kubernetes controller and command-line tool that encrypts Secrets so they can be stored in Git. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Sealed Secrets
A Kubernetes controller and command-line tool that encrypts Secrets so they can be stored in Git.
Replacements
Listings that take over the same core job as Sealed Secrets.
SOPS
Encrypts values inside YAML, JSON and env files so they can live in Git.
SOPS encrypts values inside YAML, JSON and env files for Git without an in-cluster controller. It works with age, PGP and cloud key services, and it is not limited to Kubernetes.
git-crypt
A command-line tool that transparently encrypts selected files in a Git repository.
git-crypt transparently encrypts selected files in any Git repository from the command line with no Kubernetes controller. It is not designed around Kubernetes Secrets or GitOps workflows.
transcrypt
A shell script that transparently encrypts chosen files stored in a Git repository.
transcrypt is a shell script that encrypts chosen files in a Git repository on commit. It relies on a shared password rather than per-user keys and has no Kubernetes integration.
Similar software
Related functionality, not a direct replacement.
Infisical
Open-source platform for storing and distributing application secrets.
Doppler
Hosted secrets manager that syncs environment variables across environments.
Helm
A package manager for Kubernetes that installs, upgrades and rolls back applications described as charts.
Kustomize
A template-free tool for customising Kubernetes YAML configurations without forking them.
Helmfile
A command-line tool for declaratively deploying sets of Helm charts, manifests and Kustomize configs.
Kubernetes
An open-source system for automating deployment, scaling and management of containerized applications across machines.
