add kubeseal offline guide

Author: maltesander

demos/argo-cd-git-ops/README.md

@@ -13,4 +13,11 @@ a generated certificate that is automatically used for signing via `kubeseal`.
 kubeseal -n stackable-airflow --format=yaml < airflow-credentials.yaml > sealed-airflow-credentials.yaml
 ```
 
+For "offline" usage you can first fetch the CA from the `sealed-secrets-controller` and use that for encryption when the demo / stack is not available.
+
+```sh
+kubeseal --fetch-cert --controller-name sealed-secrets-controller --controller-namespace sealed-secrets > sealed-secrets.crt
+kubeseal --cert sealed-secrets.crt -n stackable-airflow --format=yaml < airflow-credentials.yaml > sealed-airflow-credentials.yaml
+```
+
 TODO: We should probably create a script that seals all secrets and puts them in the respective stack / demo folders