Migrate from Bitnami Sealed Secrets to OpenBao for secrets management. Covers extracting existing sealed secrets, importing them into OpenBao KV engine, setting up ESO or CSI for delivery
Prerequisites checklist
Confirm these before running steps:
1Fetch all SealedSecrets in the cluster
oc get sealedsecrets --all-namespaces -o custom-columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name2Extract the decrypted Secret values (they exist as regular Secrets)
To be able to migrate, we need to know the actual secrets. These are automatically created by the SealedSecrets controller.
for ns in $(oc get sealedsecrets -A -o jsonpath='{.items[*].metadata.namespace}' | tr ' ' '\n' | sort -u); do
for s in $(oc get sealedsecrets -n "$ns" -o jsonpath='{.items[*].metadata.name}'); do
echo "--- $ns/$s ---"
oc get secret "$s" -n "$ns" -o json |
jq '.data | to_entries[] | {key: .key, value: (.value | @base64d)}'
done
done→ Success: You should see the secrets in the output
3Example output
Let's imagine we have found the following secret
Secret: openshift-config/htpasswd-secret
Key: htpasswd
Value: myuser:$xxxx....
4Import secrets into OpenBao KV engine
Replace the values accordingly
bao kv put secret/migrated/<namespace>/<secret-name> key1=value1 key2=value2Example from above
bao kv put secret/migrated/openshift-config/htpasswd-secret htpasswd=myuser:$xxxx....This must be done for each (sealed) secret found in the cluster.
5Create a ServiceAccount
Create a ServiceAccount, for example openbao-sa in the target namespace
oc create serviceaccount openbao-sa -n openshift-config6Create a dedicated OpenBao role and policy
As a good practice create a dedicated role and policy for the target namespace.
Apply policy + role
openshift-config-eso from the Commands / YAML tab.7Create a SecretStore in the target namespace
Apply from the Commands / YAML tab (
role: openshift-config-eso).→ Success: The CR should have the status store validated
8Create ExternalSecret CRs to replace SealedSecrets
Apply from the Commands / YAML tab
→ Success: The CR should have the status Secret synced
9Verify the new secrets match the original values
oc get secret <name> -n <namespace> -o jsonpath='{.data}' | jq 'to_entries[] | {key: .key, value: (.value | @base64d)}'In our example it should be:
oc get secret htpasswd-secret-openbao -n openshift-config -o jsonpath='{.data}' | jq 'to_entries[] | {key: .key, value: (.value | @base64d)}'10Repeat for each SealedSecret
Repeat the process for each SealedSecret found in the cluster.