# Use Secret Sealer

The secret sealer feature can be used to secure the sensitive data of the resources in the following two ways:

- **System to Git Sync:** To secure and sync the required resource variables from system to git, set the variable's type to **Secure Text** through the controller
- **Git to System Sync:** To secure and sync the resource details from Git to System, use the Kubeseal utility

## System to Git Sync

Below is an example of securing **Config Context values** using **Secret Sealer** and syncing the data with Git.

- Create a [**Secret Sealer**](https://docs.rafay.co/integrations/secretseal/secret_sealer/) through the controller in the required project
- Go to **Config Contexts** and open the required config context
- In **Environment Variables** or **Input Variables**, add or edit a variable that contains sensitive data
- Enable the **Sensitive** option for the variable
- Click **Save**

When a variable is marked as **Sensitive**, the system automatically applies the Secret Sealer certificate and encrypts the value before it is stored and synced to Git. The encrypted value is shown as masked in the UI and in Git.

## Git to System Sync

**Pre-requisites**

- Install the [Kubeseal](https://github.com/bitnami-labs/sealed-secrets#homebrew) utility in the system
- Download the [Secret Sealer Certificate](https://docs.rafay.co/integrations/secretseal/secret_sealer/)
- Resource secret yaml file (that contains sensitive data to be encrypted)

Below is an example to secure the resource values in a yaml file before initiating the Git to System sync process.

- Have the Kubernetes secret file named **secret.yaml**. In this example, the value of the token, **password** must be encrypted

```yaml
apiVersion: v1
data:
  password: 3332hwX0x5SXZNZmp6VWRrZTdlajJ5TEhYaDFXNGIwdQ==
kind: Secret
metadata:
  name: secret_name
```

- Run the command

`kubeseal --cert CERT --format yaml < secret.yaml > sealsecret.yaml` where,

- **CERT:** Certificate downloaded from the Secret Sealer
- **secret.yaml:** Kubernetes secret file
- **sealsecret.yaml:** The generated output file name with encrypted values

- On successful command execution, users can view the generated output file **sealsecret.yaml** where the password is encrypted/sealed

```yaml
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  creationTimestamp: null
  name: secret_name
  namespace: default
spec:
  encryptedData:
    password: AQCC0GxGS5d7SW8EDtz52pPjSI6gXvivyTSJ3m7p+3s+Ryn1P54V3avPPm2qXEuTpNPSkYSGpZ1+/11xvr36IpNhcic8liNz9aHeCWRUOzvTuEulAEljkO2uXq3BR+EZcdSJGrq41N209U1EyME/fp6u67+UZTpK+8znJJfXrmaOCuJVenmXKGfzCeia9fc2qcNx8gtd5PCGsOPuWhXd6RWuwhUW76ZTzHzK5gOZiojFpI2RZMQiSXyg0/1iGdQNnT7iByGWfbqpeFA5GkmTbwaKDwt5kgvLpEO2fuRUn5TrA8vkEcqe7N/I2yYMRxi6KZAgMGWTRWa0jn8rIBR0yzMj/qRP9WzySZ22Rbx1j5byZqEd1DRWgGWC8hg4lSkisTsBD9L04pvwB1BHe4pvlemxMXk37601znY=
  template:
    data: null
    metadata:
      creationTimestamp: null
      name: secret_name
      namespace: default
```

- The sensitive resource values are encrypted. Users can now upload this sealed yaml file to Git and sync with the system.