Kubeseal: Add support for setting the controller name via an environment variable

[tiesmaster]

Which component:
kubeseal

Is your feature request related to a problem? Please describe.
I work in an environment where the decision was made to install sealed-secrets using non-default namespace, and controller name. Because of that, it's needed to always include the name of the controller on the command-line. It would be nice to have the possibility to set the controller name, just like the controller namespace using an environment variable.

Describe the solution you'd like
Add the environment variable SEALED_SECRETS_CONTROLLER_NAME which is consumed by kubeseal to override the default controller name.

Describe alternatives you've considered
An alternative is to make use of a shell alias to set the namespace, and controller name. However, it preferable to use the CLI directly, instead of via aliases, as these are not always available (one notorious example that I can think of is when you're invoking watch ...; although, not applicable to kubeseal, it highlights the limitation).

Additional context
None

[bligneri]

It sounds like it is there ?

https://github.com/bitnami-labs/sealed-secrets?tab=readme-ov-file#how-to-use-kubeseal-if-the-controller-is-not-running-within-the-kube-system-namespace

From this page:
bash export SEALED_SECRETS_CONTROLLER_NAMESPACE=sealed-secrets kubeseal <mysecret.json >mysealedsecret.json

[tiesmaster]

@bligneri I was specifically talking about being able to set the controller name, and made the reference to controller namespace (that you are able to set that one via the environment variable you mentioned). Am I missing something here?

[alemorcuq]

@tiesmaster that environment variable does exist. Every CLI flag is configurable via an environment variable. See:

$ kubectl get all -n default
NAME                                                READY   STATUS    RESTARTS   AGE
pod/my-controller-sealed-secrets-859775b8d4-8qhlt   1/1     Running   0          5m16s

NAME                                           TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
service/kubernetes                             ClusterIP   10.96.0.1        <none>        443/TCP    6m55s
service/my-controller-sealed-secrets           ClusterIP   10.106.133.207   <none>        8080/TCP   5m16s
service/my-controller-sealed-secrets-metrics   ClusterIP   10.109.121.117   <none>        8081/TCP   5m16s

NAME                                           READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/my-controller-sealed-secrets   1/1     1            1           5m16s

NAME                                                      DESIRED   CURRENT   READY   AGE
replicaset.apps/my-controller-sealed-secrets-859775b8d4   1         1         1       5m16s

$ kubectl create secret generic my-secret --from-literal=key1=supersecret --from-literal=key2=topsecret --dry-run=client -o yaml | SEALED_SECRETS_CONTROLLER_NAME=my-controller-sealed-secrets  SEALED_SECRETS_CONTROLLER_NAMESPACE=default kubeseal -o yaml
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  creationTimestamp: null
  name: my-secret
  namespace: default
spec:
  encryptedData:
    key1: AgB0nqh1wNMuxMLytv4J/F8oElhyraShao0R1xhxaEdxq8yf4Aslxb7JMEu8xt+r8/dt6qKilg1GQ9ZkYJLjIh6opriVPR3bbmJCVDh+aAY2yhveGunpeD/MN6IUmsK+zaYDAVFG9hakKIUeg4uEzXswP68z0XsgC+mpuFxgFhuRFwfzShNpzODopjXcD9cbLOdqqw8Y8pqkezTeJBWftiHIkP07qZQS0+W/Ix8VFxroFhMe5uvJGrmJNa0VcMnZTWxiV9Ppt1dlAL/bcN0g58JpHxBOK17NigzRCE6lEmEZ0ZF3PwJuw9MiX6JpT/JWZYRuJK+PcDGA7iEleh3yk92Ihmh6kPE2zOpkr3R8Ce4m18QC1ckDRpmtXrwScoNcGiikxCLatuG6UPACApyySczfk9qvt47mArHyYCjWoh1SkdgP230g6Lss3QwuDRInoAxlU+jJMqLeywCsOirFgQMj8ua+5IRMsepPnxRSVD9puCACnhU/PTZSJyTrcmAbDmvOuuG86lC/oozTVTvnRsdmRml1I8I143uOHJPWsIC7gc7a2akLgxO4si1kGvHPU2QYiERt3Ztw43fBKmW4xcDac8IcZoO2VvtNnf6MhlYTdEsUgq+BQxT8P49VYzHKCbTEUJwGj4kJKg1mXGrcFPyAZRuiN5/CGf482vwx9rAGZ2pGfkVSEr9pAxHVBSh0GUBNH1d1ljYLwwZF/w==
    key2: AgBcKYw7AgGDLhBNfYbRiXdNNotuLtOuKpX0c9iJSybCRTs7wiZF2aC9LYxBbRw6MLkrfgCcYAUEfs/id5gSwh63MNOsyZZyYTEcKy8ATj3OUjGbnxwOHWesjCOXVpMACGHcXBg6bZLDLcuJxcFcbK9rsknOFtBWDfAIWML7Gu2/BxXavliyc6eg2i+6d4MAn95MGtGxjQcgp4plQFNaOR9OgVPqPpBBjOrYc7+y8jyWmgyEbbI6Ry/d5sXetlUi9+CKuVujsvtz8oJ8ATVvFVbZxdIYryJRVqAfxu+Ss4i3kJrV7xJMhSOtlmtObWlyeEM5ag+LOXohYfuJzq7ndV0GCs7/enMsipr/USCrM6QSivwccHD3148YIopQ0B0STe7lNqvxw/OZ2BziTdk9lAC0QVfuE2vzuzyEFWplLilXim5Pc4OCHK+4kEHc8TVPcbdJgNLzTVy/c/G8PVMMnlq9ii43voJYSIgI+0InD+mNObXdndi7ubMk3TtVJUAAaV/Y3gsOu21R64MVM4J1H7KpW9fby4Da8YCJi0iz3m40UvNRnKRazAUW2m87q0eASHdscEEnnWVVF/tm/D1YL1KDqEA8mUIg1gAjYmGewS1HxAintNSPPm6mckANvL0Pi0Zl4BPNyzeNTKUBYe1JOMSnri0wHsvBfGBqRlWy/pwyKyXuYn2Fq/1Z5ravqJZfMRZi/27EL0LRE+g=
  template:
    metadata:
      creationTimestamp: null
      name: my-secret
      namespace: default

[tiesmaster]

@alemorcuq I see now, although I briefly searched the code, I didn't see the SEALED_SECRETS is set as env var prefix. I got it working now. Very nice!

This might be useful to add it to the README/faq. Do you think it's worth it?

[alemorcuq]

@tiesmaster I was pretty sure it was there in the documentation, but as you say I can't find it anywhere. Yes, I definitely think this is something that should be in there.

[tiesmaster]

Cool! I'll make a PR to update that.