[stable/sealed-secrets] Add kubeseal section to readme (#16438)

* Add kubeseal section to readme

Signed-off-by: stefanprodan <stefan.prodan@gmail.com>

* Add kubeseal controller name and ns to notes

Signed-off-by: stefanprodan <stefan.prodan@gmail.com>

stable/sealed-secrets/Chart.yaml

@@ -1,6 +1,6 @@
 name: sealed-secrets
 description: A Helm chart for Sealed Secrets
-version: 1.3.3
+version: 1.3.4
 appVersion: 0.8.1
 kubeVersion: ">=1.9.0-0"
 home: https://github.com/bitnami-labs/sealed-secrets

stable/sealed-secrets/README.md

@@ -26,6 +26,20 @@ $ helm delete [--purge] my-release
 
 The command removes all the Kubernetes components associated with the chart and deletes the release.
 
+## Using kubeseal
+
+Install the kubeseal CLI by downloading the binary from [sealed-secrets/releases](https://github.com/bitnami-labs/sealed-secrets/releases).
+
+Fetch the public key by passing the release name and namespace:
+
+```bash
+kubeseal --fetch-cert \
+--controller-name=my-release \
+--controller-namespace=my-release-namespace \
+> pub-cert.pem
+```
+
+Read about kubeseal usage on [sealed-secrets docs](https://github.com/bitnami-labs/sealed-secrets#usage).
 
 ## Configuration
 

stable/sealed-secrets/templates/NOTES.txt

@@ -4,23 +4,34 @@ You should now be able to create sealed secrets.
 
 GOOS=$(go env GOOS)
 GOARCH=$(go env GOARCH)
-wget https://github.com/bitnami-labs/sealed-secrets/releases/download/$release/kubeseal-$GOOS-$GOARCH
+wget https://github.com/bitnami-labs/sealed-secrets/releases/download/{{ .Values.image.tag }}/kubeseal-$GOOS-$GOARCH
 sudo install -m 755 kubeseal-$GOOS-$GOARCH /usr/local/bin/kubeseal
 
 2. Create a sealed secret file
 
 # note the use of `--dry-run` - this does not create a secret in your cluster
-kubectl create secret generic secret-name --dry-run --from-literal=foo=bar -o [json|yaml] | kubeseal --format [json|yaml] > mysealedsecret.[json|yaml]
+kubectl create secret generic secret-name --dry-run --from-literal=foo=bar -o [json|yaml] | \
+ kubeseal \
+ --controller-name={{ template "sealed-secrets.fullname" . }} \
+ --controller-namespace={{ .Release.Namespace }} \
+ --format [json|yaml] > mysealedsecret.[json|yaml]
 
 The file mysealedsecret.[json|yaml] is a commitable file.
 
 If you would rather not need access to the cluster to generate the sealed secret you can run
 
-kubeseal --fetch-cert > mycert.pem
+kubeseal \
+ --controller-name={{ template "sealed-secrets.fullname" . }} \
+ --controller-namespace={{ .Release.Namespace }} \
+ --fetch-cert > mycert.pem
 
 to retrieve the public cert used for encryption and store it locally. You can then run 'kubeseal --cert mycert.pem' instead to use the local cert e.g.
 
-kubectl create secret generic secret-name --dry-run --from-literal=foo=bar -o [json|yaml] | kubeseal --format [json|yaml] --cert mycert.pem > mysealedsecret.[json|yaml]
+kubectl create secret generic secret-name --dry-run --from-literal=foo=bar -o [json|yaml] | \
+kubeseal \
+ --controller-name={{ template "sealed-secrets.fullname" . }} \
+ --controller-namespace={{ .Release.Namespace }} \
+ --format [json|yaml] --cert mycert.pem > mysealedsecret.[json|yaml]
 
 3. Apply the sealed secret
 
@@ -30,9 +41,3 @@ Running 'kubectl get secret secret-name -o [json|yaml]' will show the decrypted
 
 Both the SealedSecret and generated Secret must have the same name and namespace.
 
-{{ if not (eq .Release.Namespace "kube-system") }}
---------------------------------------------------------------------------------------------------
-
-Please Note: Since this chart was not installed in the kube-system namespace all kubeseal commands must pass the option `--controller-namespace {{ .Release.Namespace }}`
-
-{{ end }}