Manage Kubernetes secrets
without touching kubectl.
Krypton is a lightweight UI and API backed directly by native Secret objects. SSO proves who you are, annotations decide what you may see, and every change is versioned — with Velero, GitOps, and RBAC still in charge underneath.
Secrets dashboard
Browse namespaces, create and edit secrets with masked values until you reveal them.
One-click rollbacks
Every write snapshots first into <name>-vN. Restores are reversible by construction.
Hybrid authorization
Per-secret annotations override one namespace fallback. Admins always pass.
OIDC SSO
Keycloak, Entra ID, Okta, Google, GitHub. Users never need cluster credentials.
Consumer restarts
Env-var consumers need a rollout after edits. Volume mounts sync on their own.
REST API
Drive everything from scripts: CRUD, versions, restores, restarts, auth, config.
Use the UI, the API, or both. One platform over native Secrets.
Plays nicely with your identity provider — and your platform
Dashboard
Stay productive without leaving the browser
Namespaces on the left, secrets in the middle, history one click away. Values stay masked until you reveal them — and the audit log only ever records key names.
Namespaces
alice@company.com
dev-team · can edit
database-credentials
v3Automation
Drive Krypton from scripts
Plain REST over JSON with session-cookie auth. Values cross the API as plain strings — base64 stays inside Kubernetes.
- ✓CRUD plus versions, restores, and consumer restarts
- ✓resourceVersion writes: 409 instead of silent clobbers
- ✓Every restore snapshots first — rollbacks stay reversible
# Headless authz checks (no browser)
ALICE=$(node sandbox/scripts/mint-jwt.mjs \
--email alice@company.com --groups dev-team)
curl --cookie "krypton_session=$ALICE" \
localhost:3000/api/namespaces/krypton-test/secrets
# Optimistic-concurrency update (409 on drift)
curl --cookie "krypton_session=$ALICE" -X PUT \
-H 'Content-Type: application/json' \
-d '{"data":{"API_KEY":"<rotated>"},"resourceVersion":"'$RV'"}' \
localhost:3000/api/namespaces/krypton-test/secrets/demo-secret
# Reversible restore — snapshots current state first
curl --cookie "krypton_session=$ALICE" -X POST \
-d '{"version":1}' \
localhost:3000/api/namespaces/krypton-test/secrets/demo-secret/restoreDeployment
Ship it your way
Stateless by design — all state lives in Kubernetes Secrets, so more than one replica is always safe.
Sandbox
kind + Dex + seeded fixtures. Real SSO on localhost in one command.
$ make upRaw manifests
Namespace Role by default, ClusterRole when you need the full dashboard.
$ kubectl apply -f app/k8s/Helm + OCI
Umbrella chart or direct OCI install. Chart version tracks the app release.
$ helm install krypton oci://ghcr.io/egose/charts/kryptonOpen source
Open source from day one
Apache-2.0 licensed. No database to operate, no proprietary control plane — Kubernetes is the source of truth and the code stays boring on purpose.
Stop pasting secrets into chat.
Give developers self-service secrets with SSO login, group-based access, and versioned history — while platform keeps RBAC, audit, and GitOps exactly as they are.