sealed-secrets-v0.40.0

v0.40.0 (2026-09-10T16:02:19Z)

New v0.40.0 release!

Changelog

• 9029394 Add imports to force vendoring required codegen tools (#2020)
• 641cd01 Bump Golang to 1.26.8 (#2050)
• 20925c9 Bump distroless/static from 9197324 to f2ea270 in /docker (#2038)
• 2937d2b Bump github.com/onsi/gomega from 1.42.1 to 1.43.0 (#2044)
• 78f5131 Bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 (#2047)
• 0b606ae Bump golang.org/x/crypto from 0.55.0 to 0.56.0 (#2048)
• ecc9238 Bump k8s.io/api from 0.36.3 to 0.36.4 (#2037)
• 2b184ce Bump k8s.io/client-go from 0.36.3 to 0.36.4 (#2039)
• 5552a01 Bump k8s.io/client-go from 0.36.4 to 0.37.0 (#2041)
• b8609f7 Bump k8s.io/code-generator from 0.36.3 to 0.36.4 (#2036)
• eddf8c2 Bump k8s.io/code-generator from 0.36.4 to 0.37.0 (#2042)
• 54c805d Enable encryptedData to be omitted by setting key to null in template (#1871)
• e27ce45 Release carvel package 2.19.3 (#2032)
• 7117727 Release notes 0.40.0 (#2052)
• 32171b6 [Security] Stop /v1/rotate from acting as a decryption oracle (#2049)

Installation Instructions

Cluster-side

Install the SealedSecret CRD and server-side controller into the kube-system namespace:

kubectl apply -f https://github.com/bitnami/sealed-secrets/releases/download/v0.40.0/controller.yaml

Client-side

Install the client-side tool into /usr/local/bin/:

Linux x86_64:

curl -OL "https://github.com/bitnami/sealed-secrets/releases/download/v0.40.0/kubeseal-0.40.0-linux-amd64.tar.gz"
tar -xvzf kubeseal-0.40.0-linux-amd64.tar.gz kubeseal
sudo install -m 755 kubeseal /usr/local/bin/kubeseal

macOS:
The kubeseal client is available on homebrew:

brew install kubeseal

MacPorts:

The kubeseal client is available on MacPorts:

port install kubeseal

Nixpkgs

The kubeseal client is available on Nixpkgs: (DISCLAIMER: Not maintained by bitnami)

nix-env -iA nixpkgs.kubeseal

Other OS/Arch:
Binaries for other OS/arch combinations are attached to this release below.

If you just want the latest client tool, it can be installed into
$GOPATH/bin with:

go install github.com/bitnami/sealed-secrets/cmd/kubeseal@main

You can specify a release tag or a commit SHA instead of main.

The go install command will place the kubeseal binary at $GOPATH/bin:

$(go env GOPATH)/bin/kubeseal

Release Notes

Please read the RELEASE_NOTES which contain among other things important information for those upgrading from previous releases.

Thanks!

helm-v2.20.0

Helm chart for the sealed-secrets controller.

sealed-secrets-v0.39.1

v0.39.1 (2026-08-20T08:45:45Z)

New v0.39.1 release!

Changelog

• 83387fc Bump Golang to 1.26.6 (#2028)
• e81bbe4 Bump Golang to 1.26.7 (#2029)
• 08bbee2 Bump github.com/onsi/ginkgo/v2 from 2.32.0 to 2.32.1 (#2027)
• 74d25c0 Bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#2026)
• aeb6bfb Release carvel package 2.19.2 (#2024)
• af17f82 Release notes 0.39.1 (#2030)
• 070ad16 test(controller): fix flaky TestReadKey RSA key comparison (#2021)

Installation Instructions

Cluster-side

Install the SealedSecret CRD and server-side controller into the kube-system namespace:

kubectl apply -f https://github.com/bitnami/sealed-secrets/releases/download/v0.39.1/controller.yaml

Client-side

Install the client-side tool into /usr/local/bin/:

Linux x86_64:

curl -OL "https://github.com/bitnami/sealed-secrets/releases/download/v0.39.1/kubeseal-0.39.1-linux-amd64.tar.gz"
tar -xvzf kubeseal-0.39.1-linux-amd64.tar.gz kubeseal
sudo install -m 755 kubeseal /usr/local/bin/kubeseal

macOS:
The kubeseal client is available on homebrew:

brew install kubeseal

MacPorts:

The kubeseal client is available on MacPorts:

port install kubeseal

Nixpkgs

The kubeseal client is available on Nixpkgs: (DISCLAIMER: Not maintained by bitnami)

nix-env -iA nixpkgs.kubeseal

Other OS/Arch:
Binaries for other OS/arch combinations are attached to this release below.

If you just want the latest client tool, it can be installed into
$GOPATH/bin with:

go install github.com/bitnami/sealed-secrets/cmd/kubeseal@main

You can specify a release tag or a commit SHA instead of main.

The go install command will place the kubeseal binary at $GOPATH/bin:

$(go env GOPATH)/bin/kubeseal

Release Notes

Please read the RELEASE_NOTES which contain among other things important information for those upgrading from previous releases.

Thanks!

helm-v2.19.3

Helm chart for the sealed-secrets controller.

sealed-secrets-v0.39.0

v0.39.0 (2026-08-18T09:46:07Z)

New v0.39.0 release!

Changelog

• 409f0f0 Add --metrics-omit-secret-labels to skip per-SealedSecret labels on condition_info (#1972)
• ce8e072 Allow setting hostUsers on deployment (#1978)
• 3d09823 Bump distroless/static from 3592aa8 to 9197324 in /docker (#2008)
• 15aa439 Bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 (#2009)
• fb7da1e Bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 (#2011)
• 7f4a573 Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 (#2016)
• 159d530 Bump golang.org/x/crypto from 0.53.0 to 0.54.0 (#2007)
• 315e95c Bump k8s.io/client-go from 0.36.2 to 0.36.3 (#2012)
• de72a97 Bump k8s.io/code-generator from 0.36.2 to 0.36.3 (#2014)
• 0f805b9 Rate-limit the /v1/rotate endpoint (#1971)
• 195987c Release notes 0.39.0 (#2022)
• 6a6e888 Revert ArtifactHub repository metadata OCI push (#2005)
• 1c69578 fix(controller): start HTTP early for large additional-namespaces lists (#2018)
• 66db186 fix: stop /v1/verify from acting as a decryption oracle (#2019)
• abae13c test(controller): poll for server readiness instead of sleeping (#2010)

Installation Instructions

Cluster-side

Install the SealedSecret CRD and server-side controller into the kube-system namespace:

kubectl apply -f https://github.com/bitnami/sealed-secrets/releases/download/v0.39.0/controller.yaml

Client-side

Install the client-side tool into /usr/local/bin/:

Linux x86_64:

curl -OL "https://github.com/bitnami/sealed-secrets/releases/download/v0.39.0/kubeseal-0.39.0-linux-amd64.tar.gz"
tar -xvzf kubeseal-0.39.0-linux-amd64.tar.gz kubeseal
sudo install -m 755 kubeseal /usr/local/bin/kubeseal

macOS:
The kubeseal client is available on homebrew:

brew install kubeseal

MacPorts:

The kubeseal client is available on MacPorts:

port install kubeseal

Nixpkgs

The kubeseal client is available on Nixpkgs: (DISCLAIMER: Not maintained by bitnami)

nix-env -iA nixpkgs.kubeseal

Other OS/Arch:
Binaries for other OS/arch combinations are attached to this release below.

If you just want the latest client tool, it can be installed into
$GOPATH/bin with:

go install github.com/bitnami/sealed-secrets/cmd/kubeseal@main

You can specify a release tag or a commit SHA instead of main.

The go install command will place the kubeseal binary at $GOPATH/bin:

$(go env GOPATH)/bin/kubeseal

Release Notes

Please read the RELEASE_NOTES which contain among other things important information for those upgrading from previous releases.

Thanks!

helm-v2.19.2

Helm chart for the sealed-secrets controller.

sealed-secrets-v0.38.4

v0.38.4 (2026-07-03T12:45:25Z)

New v0.38.4 release!

Changelog

• 0cc547a Release notes 0.38.4 (#2003)

Installation Instructions

Cluster-side

Install the SealedSecret CRD and server-side controller into the kube-system namespace:

kubectl apply -f https://github.com/bitnami/sealed-secrets/releases/download/v0.38.4/controller.yaml

Client-side

Install the client-side tool into /usr/local/bin/:

Linux x86_64:

curl -OL "https://github.com/bitnami/sealed-secrets/releases/download/v0.38.4/kubeseal-0.38.4-linux-amd64.tar.gz"
tar -xvzf kubeseal-0.38.4-linux-amd64.tar.gz kubeseal
sudo install -m 755 kubeseal /usr/local/bin/kubeseal

macOS:
The kubeseal client is available on homebrew:

brew install kubeseal

MacPorts:

The kubeseal client is available on MacPorts:

port install kubeseal

Nixpkgs

The kubeseal client is available on Nixpkgs: (DISCLAIMER: Not maintained by bitnami)

nix-env -iA nixpkgs.kubeseal

Other OS/Arch:
Binaries for other OS/arch combinations are attached to this release below.

If you just want the latest client tool, it can be installed into
$GOPATH/bin with:

go install github.com/bitnami/sealed-secrets/cmd/kubeseal@main

You can specify a release tag or a commit SHA instead of main.

The go install command will place the kubeseal binary at $GOPATH/bin:

$(go env GOPATH)/bin/kubeseal

Release Notes

Please read the RELEASE_NOTES which contain among other things important information for those upgrading from previous releases.

Thanks!

sealed-secrets-v0.38.3

v0.38.3 (2026-07-03T10:35:56Z)

New v0.38.3 release!

Changelog

• cae5fdd Release notes 0.38.3 (#2002)

Installation Instructions

Cluster-side

Install the SealedSecret CRD and server-side controller into the kube-system namespace:

kubectl apply -f https://github.com/bitnami/sealed-secrets/releases/download/v0.38.3/controller.yaml

Client-side

Install the client-side tool into /usr/local/bin/:

Linux x86_64:

curl -OL "https://github.com/bitnami/sealed-secrets/releases/download/v0.38.3/kubeseal-0.38.3-linux-amd64.tar.gz"
tar -xvzf kubeseal-0.38.3-linux-amd64.tar.gz kubeseal
sudo install -m 755 kubeseal /usr/local/bin/kubeseal

macOS:
The kubeseal client is available on homebrew:

brew install kubeseal

MacPorts:

The kubeseal client is available on MacPorts:

port install kubeseal

Nixpkgs

The kubeseal client is available on Nixpkgs: (DISCLAIMER: Not maintained by bitnami)

nix-env -iA nixpkgs.kubeseal

Other OS/Arch:
Binaries for other OS/arch combinations are attached to this release below.

If you just want the latest client tool, it can be installed into
$GOPATH/bin with:

go install github.com/bitnami/sealed-secrets/cmd/kubeseal@main

You can specify a release tag or a commit SHA instead of main.

The go install command will place the kubeseal binary at $GOPATH/bin:

$(go env GOPATH)/bin/kubeseal

Release Notes

Please read the RELEASE_NOTES which contain among other things important information for those upgrading from previous releases.

Thanks!

sealed-secrets-v0.38.2

v0.38.2 (2026-07-03T09:39:04Z)

New v0.38.2 release!

Changelog

• ab52b38 Add Artifact Hub badge to README (#1999)
• 2623137 Bump github.com/onsi/ginkgo/v2 from 2.30.0 to 2.32.0 (#1998)
• c2dc705 Bump github.com/onsi/gomega from 1.41.0 to 1.42.0 (#1995)
• 183e91c Bump github.com/onsi/gomega from 1.42.0 to 1.42.1 (#1997)
• 792723c Bump k8s.io/api from 0.36.1 to 0.36.2 (#1994)
• 5e4abed Bump k8s.io/client-go from 0.36.1 to 0.36.2 (#1996)
• e256932 Bump k8s.io/code-generator from 0.36.1 to 0.36.2 (#1993)
• 33b890d Publish Artifact Hub repository metadata for verified publisher status (#2000)
• 20c250b Release carvel package 2.19.0 (#1991)
• e88bf0a Release notes 0.38.2 (#2001)

Installation Instructions

Cluster-side

Install the SealedSecret CRD and server-side controller into the kube-system namespace:

kubectl apply -f https://github.com/bitnami/sealed-secrets/releases/download/v0.38.2/controller.yaml

Client-side

Install the client-side tool into /usr/local/bin/:

Linux x86_64:

curl -OL "https://github.com/bitnami/sealed-secrets/releases/download/v0.38.2/kubeseal-0.38.2-linux-amd64.tar.gz"
tar -xvzf kubeseal-0.38.2-linux-amd64.tar.gz kubeseal
sudo install -m 755 kubeseal /usr/local/bin/kubeseal

macOS:
The kubeseal client is available on homebrew:

brew install kubeseal

MacPorts:

The kubeseal client is available on MacPorts:

port install kubeseal

Nixpkgs

The kubeseal client is available on Nixpkgs: (DISCLAIMER: Not maintained by bitnami)

nix-env -iA nixpkgs.kubeseal

Other OS/Arch:
Binaries for other OS/arch combinations are attached to this release below.

If you just want the latest client tool, it can be installed into
$GOPATH/bin with:

go install github.com/bitnami/sealed-secrets/cmd/kubeseal@main

You can specify a release tag or a commit SHA instead of main.

The go install command will place the kubeseal binary at $GOPATH/bin:

$(go env GOPATH)/bin/kubeseal

Release Notes

Please read the RELEASE_NOTES which contain among other things important information for those upgrading from previous releases.

Thanks!

helm-v2.19.1

Helm chart for the sealed-secrets controller.