Who is able to decrypt a SealedSecret?

Why this is the answer

Encryption is one-way from the author's point of view: only the controller running in the target cluster holds the private key, so not even the person who sealed the value can read it back. The public key is what kubeseal uses to encrypt, and holding it grants no ability to decrypt — that asymmetry is the whole design. Nothing in the resource lets an administrator decrypt it. And the author keeping a copy would reintroduce the plaintext this is meant to eliminate.