---
- name: Deploy Sealed Secrets (kubeseal controller + CLI)
  hosts: manager_nodes
  become: true
  roles:
    - sealed_secrets