kubeseal: error: cannot fetch certificate from controller

TL;DR

kubeseal cannot reach the sealed-secrets controller to fetch its public cert: wrong controller name, wrong namespace, or wrong cluster context. Pass the right --controller-name, --controller-namespace, and context, and the fetch succeeds.

Error

kubeseal: error: cannot fetch certificate from controller

Steps

1. Check your context: confirm kubectl points at the cluster running the controller. Expected: the right cluster, not a stale context.
2. Find the controller: list deployments or pods for the sealed-secrets controller and note its name and namespace. Expected: the real name and namespace, which often differ from defaults after custom installs.
3. Fetch with explicit flags: run kubeseal with the controller name and namespace you found. Expected: the certificate downloads.
4. Check RBAC: the fetching identity needs permission to read the controller's service or secret. Expected: no forbidden errors once the flags are right.
5. Save the certificate and use it for offline sealing. Expected: kubeseal --cert works without contacting the cluster.

When to use

• kubeseal fails fetching the controller certificate
• Custom controller names or namespaces
• Sealing for a different cluster than your current context

When not to use

• Sealing succeeds but the controller cannot decrypt (key mismatch)
• Controller not installed (install it first)

Tool compatibility

• kubeseal CLI; sealed-secrets controller service

Variant phrasings

kubeseal wrong controller namespace

Pass --controller-namespace explicitly; the default only fits default installs.

fetch cert wrong cluster

Switch kubectl context to the target cluster before fetching.

Why it happens

kubeseal discovers the controller via the Kubernetes API using default name and namespace assumptions. Custom installs, multiple clusters, or a stale context break those assumptions, and the fetch fails before any crypto happens.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_cBrRPiIEWj0MFwUkdPostA