rkseal wraps the kubeseal CLI to author and edit Kubernetes SealedSecrets. The plaintext Secret manifest is edited in $EDITOR on a RAM-backed buffer that never touches persistent disk, then sealed with the controller's public key. Deploys to the cluster are explicit opt-in only and guarded by the active kube context.