Skip to content

v0.8.3

Choose a tag to compare

View all tags
@mkmik mkmik released this 29 Aug 11:05
v0.8.3
ec80fce
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

Announcement

This release contains a fix for a possible secret leak that can happen when sealing existing secrets that have been retrieved from a cluster (e.g. with kubectl get) where they have been created with kubectl apply (as opposed to kubectl create).
This potential problem has been introduced v0.8.0 when kubeseal learned how to preserve annotations and labels.

Please check your existing sealed secret sources for any annotation kubectl.kubernetes.io/last-applied-configuration, because that annotation would contain your original secrets in clear.

This release strips this annotation (and a similar annotation created by the kubcfg tool)

Changelog

Fixes in this release:

  • Round-tripping secrets can leak cleartext in last-applied-configuration (#227)

The full Changelog is maintained in https://github.com/bitnami-labs/sealed-secrets/milestone/6?closed=1

Install

Client side

Install client-side tool into /usr/local/bin/:

  • Linux x86_64:
wget https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.8.3/kubeseal-linux-amd64 -O kubeseal
sudo install -m 755 kubeseal /usr/local/bin/kubeseal
  • Macos: (might lag a few hours behind a new release)

brew install kubeseal
  • Other OS/arch: you might find binaries for your OS/arch combo attached to this release below.

Cluster side

Install SealedSecret CRD, server-side controller into kube-system namespace.

$ kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.8.3/controller.yaml

NOTE: If you can't (or don't want) to use the kube-system namespace, please consider this approach

NOTE: if you want to install it on a GKE cluster for which your user account doesn't have admin rights, please read this

NOTE: since the helm chart is currently maintained elsewhere (see https://github.com/helm/charts/tree/master/stable/sealed-secrets) the update of the helm chart might not happen in sync with releases here.

Assets 8
Loading