Usage of /usr/bin/kubeseal:
      --add_dir_header                      If true, adds the file directory to the header of the log messages
      --allow-empty-data                    Allow empty data in the secret object
      --alsologtostderr                     log to standard error as well as files (no effect when -logtostderr=true)
      --alsologtostderrthreshold severity   logs at or above this threshold go to stderr when -alsologtostderr=true (no effect when -logtostderr=true)
      --as string                           Username to impersonate for the operation
      --as-group stringArray                Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
      --as-uid string                       UID to impersonate for the operation
      --cert string                         Certificate / public key file/URL to use for encryption. Overrides --controller-*
      --certificate-authority string        Path to a cert file for the certificate authority
      --client-certificate string           Path to a client certificate file for TLS
      --client-key string                   Path to a client key file for TLS
      --cluster string                      The name of the kubeconfig cluster to use
      --context string                      The name of the kubeconfig context to use
      --controller-name string              Name of sealed-secrets controller. (default "sealed-secrets-controller")
      --controller-namespace string         Namespace of sealed-secrets controller. (default "kube-system")
      --disable-compression                 If true, opt-out of response compression for all requests to the server
      --fetch-cert                          Write certificate to stdout. Useful for later use with --cert
  -o, --format string                       Output format for sealed secret. Either json or yaml (default "json")
      --from-file strings                   (only with --raw) Secret items can be sourced from files. Pro-tip: you can use /dev/stdin to read pipe input. This flag tries to follow the same syntax as in kubectl
      --help                                Print this help message
      --insecure-skip-tls-verify            If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
      --kubeconfig string                   Path to a kube config. Only required if out-of-cluster
      --legacy_stderr_threshold_behavior    If true, stderrthreshold is ignored when logtostderr=true (legacy behavior). If false, stderrthreshold is honored even when logtostderr=true (default true)
      --log_backtrace_at traceLocation      when logging hits line file:N, emit a stack trace (default :0)
      --log_dir string                      If non-empty, write log files in this directory (no effect when -logtostderr=true)
      --log_file string                     If non-empty, use this log file (no effect when -logtostderr=true)
      --log_file_max_size uint              Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)
      --logtostderr                         log to standard error instead of files (default true)
      --merge-into string                   Merge items from secret into an existing sealed secret file, updating the file in-place instead of writing to stdout.
      --name string                         Name of the sealed secret (required with --raw and default (strict) scope)
  -n, --namespace string                    If present, the namespace scope for this CLI request
      --one_output                          If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true)
      --password string                     Password for basic authentication to the API server
      --proxy-url string                    If provided, this URL will be used to connect via proxy
      --raw                                 Encrypt a raw value passed via the --from-* flags instead of the whole secret object
      --re-encrypt                          Re-encrypt the given sealed secret to use the latest cluster key.
      --recovery-private-key strings        Private key filename used by the --recovery-unseal command. Multiple files accepted either via comma separated list or by repetition of the flag. Either PEM encoded private keys or a backup of a json/yaml encoded k8s sealed-secret controller secret (and v1.List) are accepted.
      --recovery-unseal                     Decrypt a sealed secrets file obtained from stdin, using the private key passed with --recovery-private-key. Intended to be used in disaster recovery mode.
      --request-timeout string              The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
      --scope string                        Set the scope of the sealed secret: strict, namespace-wide, cluster-wide (defaults to strict). Mandatory for --raw, otherwise the 'sealedsecrets.bitnami.com/cluster-wide' and 'sealedsecrets.bitnami.com/namespace-wide' annotations on the input secret can be used to select the scope. (default "strict")
  -w, --sealed-secret-file string           Sealed-secret (output) file
  -f, --secret-file string                  Secret (input) file
      --server string                       The address and port of the Kubernetes API server
      --skip_headers                        If true, avoid header prefixes in the log messages
      --skip_log_headers                    If true, avoid headers when opening log files (no effect when -logtostderr=true)
      --stderrthreshold severity            logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true unless -legacy_stderr_threshold_behavior=false) (default 2)
      --tls-server-name string              If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
      --token string                        Bearer token for authentication to the API server
      --user string                         The name of the kubeconfig user to use
      --username string                     Username for basic authentication to the API server
  -v, --v Level                             number for the log level verbosity
      --validate                            Validate that the sealed secret can be decrypted
      --version                             Print version information and exit
      --vmodule moduleSpec                  comma-separated list of pattern=N settings for file-filtered logging