CHART NAME: {{ .Chart.Name }}
CHART VERSION: {{ .Chart.Version }}
APP VERSION: {{ .Chart.AppVersion }}

⚠ WARNING: Since August 28th, 2025, only a limited subset of images/charts are available for free.
    Subscribe to Bitnami Secure Images to receive continued support and security updates.
    More info at https://bitnami.com and https://github.com/bitnami/containers/issues/83267

{{ if .Values.createController -}}

** Please be patient while the chart is being deployed **

Watch the SealedSecret controller status using the command:

    kubectl get deploy -w --namespace {{ include "common.names.namespace" . }} -l app.kubernetes.io/name={{ include "common.names.name" . }},app.kubernetes.io/instance={{ .Release.Name }}

Once the controller is up and ready, you should be able to create sealed secrets.

1. Install the client-side tool (kubeseal) as explained in the docs below:

    https://github.com/bitnami-labs/sealed-secrets#installation-from-source

2. Create a sealed secret file running the command below:

    kubectl create secret generic secret-name --dry-run=client --from-literal=foo=bar -o yaml | \
    kubeseal \
      --controller-name={{ include "common.names.fullname" . }} \
      --controller-namespace={{ include "common.names.namespace" . }} \
      --format yaml > mysealedsecret.yaml

The file mysealedsecret.yaml is a commitable file.

If you would rather not need access to the cluster to generate the sealed secret you can run:

    kubeseal \
      --controller-name={{ include "common.names.fullname" . }} \
      --controller-namespace={{ include "common.names.namespace" . }} \
      --format yaml > mysealedsecret.yaml

to retrieve the public cert used for encryption and store it locally. You can then run 'kubeseal --cert mycert.pem' instead to use the local cert e.g.

    kubectl create secret generic secret-name --dry-run=client --from-literal=foo=bar -o yaml | \
    kubeseal \
      --controller-name={{ include "common.names.fullname" . }} \
      --controller-namespace={{ include "common.names.namespace" . }} \
      --format yaml --cert mycert.pem > mysealedsecret.yaml

3. Apply the sealed secret:

    kubectl create -f mysealedsecret.yaml

Running 'kubectl get secret secret-name -o yaml' will show the decrypted secret that was generated from the sealed secret.

Both the SealedSecret and generated Secret must have the same name and namespace.

{{- include "common.warnings.rollingTag" .Values.image }}
{{- end }}
{{- include "common.warnings.resources" (dict "sections" (list "") "context" $) }}
{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image) "context" $) }}
{{- include "common.errors.insecureImages" (dict "images" (list .Values.image) "context" $) }}