secret-management
starsforks
How to install secret-management?
ancoleman/ai-design-components/secret-management
$npx -y skills add ancoleman/ai-design-components --skill secret-managementManaging secrets (API keys, database credentials, certificates) with Vault, cloud providers, and Kubernetes. Use when storing sensitive data, rotating credentials, syncing secrets to Kubernetes, implementing dynamic secrets, or scanning code for leaked secrets.
SKILL.md
| 1 | # Managing Secrets |
| 2 | |
| 3 | Secure storage, rotation, and delivery of secrets (API keys, database credentials, TLS certificates) for applications and infrastructure. |
| 4 | |
| 5 | ## When to Use This Skill |
| 6 | |
| 7 | Use when: |
| 8 | - Storing API keys, database credentials, or encryption keys |
| 9 | - Implementing secret rotation (manual or automatic) |
| 10 | - Syncing secrets from external stores to Kubernetes |
| 11 | - Setting up dynamic secrets (database, cloud providers) |
| 12 | - Scanning code for leaked secrets |
| 13 | - Implementing zero-knowledge patterns |
| 14 | - Meeting compliance requirements (SOC 2, ISO 27001, PCI DSS) |
| 15 | |
| 16 | ## Quick Decision Frameworks |
| 17 | |
| 18 | ### Framework 1: Choosing a Secret Store |
| 19 | |
| 20 | | Scenario | Primary Choice | Alternative | |
| 21 | |----------|----------------|-------------| |
| 22 | | Kubernetes + Multi-Cloud | Vault + ESO | Cloud Secret Manager + ESO | |
| 23 | | Kubernetes + Single Cloud | Cloud Secret Manager + ESO | Vault + ESO | |
| 24 | | Serverless (AWS Lambda) | AWS Secrets Manager | AWS Parameter Store | |
| 25 | | Multi-Cloud Enterprise | HashiCorp Vault | Doppler (SaaS) | |
| 26 | | Small Team (<10 apps) | Doppler, Infisical | 1Password Secrets Automation | |
| 27 | | GitOps-Centric | SOPS (git-encrypted) | Sealed Secrets (K8s-only) | |
| 28 | |
| 29 | **Decision Tree:** |
| 30 | - Kubernetes? → External Secrets Operator (ESO) with chosen backend |
| 31 | - Single cloud? → Cloud-native (AWS/GCP/Azure) |
| 32 | - Multi-cloud/on-prem? → HashiCorp Vault |
| 33 | - GitOps? → SOPS or Sealed Secrets |
| 34 | |
| 35 | ### Framework 2: Static vs. Dynamic Secrets |
| 36 | |
| 37 | | Secret Type | Use Dynamic? | TTL | Solution | |
| 38 | |-------------|-------------|-----|----------| |
| 39 | | Database credentials | YES | 1 hour | Vault DB engine | |
| 40 | | Cloud IAM (AWS/GCP) | YES | 15 min | Vault cloud engine | |
| 41 | | SSH/RDP access | YES | 5 min | Vault SSH engine | |
| 42 | | TLS certificates | YES | 24 hours | Vault PKI / cert-manager | |
| 43 | | Third-party API keys | NO | Quarterly | Vault KV v2 (manual rotation) | |
| 44 | |
| 45 | ### Framework 3: Kubernetes Secret Delivery |
| 46 | |
| 47 | | Method | Use Case | Rotation | Restart Required | |
| 48 | |--------|----------|----------|------------------| |
| 49 | | **External Secrets Operator** | Static secrets, periodic sync | Polling (1h) | Yes | |
| 50 | | **Secrets Store CSI Driver** | File-based, watch rotation | inotify | No | |
| 51 | | **Vault Secrets Operator** | Vault-specific, dynamic | Automatic renewal | Optional | |
| 52 | |
| 53 | ## HashiCorp Vault Fundamentals |
| 54 | |
| 55 | ### Core Components |
| 56 | |
| 57 | - **Secrets Engines**: KV v2 (static), Database (dynamic), AWS, PKI, SSH |
| 58 | - **Auth Methods**: Kubernetes, JWT/OIDC, AppRole, LDAP |
| 59 | - **Policies**: HCL-based access control (least privilege) |
| 60 | - **Leases**: TTL for secrets, auto-renewal, auto-revocation |
| 61 | |
| 62 | ### Static Secrets (KV v2) |
| 63 | |
| 64 | ```bash |
| 65 | # Create secret |
| 66 | vault kv put secret/myapp/config api_key=sk_live_EXAMPLE |
| 67 | |
| 68 | # Read secret |
| 69 | vault kv get secret/myapp/config |
| 70 | |
| 71 | # List versions |
| 72 | vault kv metadata get secret/myapp/config |
| 73 | ``` |
| 74 | |
| 75 | ### Dynamic Database Credentials |
| 76 | |
| 77 | ```bash |
| 78 | # Configure PostgreSQL |
| 79 | vault write database/config/postgres \ |
| 80 | plugin_name=postgresql-database-plugin \ |
| 81 | connection_url="postgresql://{{username}}:{{password}}@postgres:5432/mydb" |
| 82 | |
| 83 | # Create role |
| 84 | vault write database/roles/app-role \ |
| 85 | db_name=postgres \ |
| 86 | creation_statements="CREATE ROLE \"{{name}}\"..." \ |
| 87 | default_ttl="1h" |
| 88 | |
| 89 | # Generate credentials |
| 90 | vault read database/creds/app-role |
| 91 | ``` |
| 92 | |
| 93 | For detailed Vault architecture, see `references/vault-architecture.md`. |
| 94 | |
| 95 | ## Kubernetes Integration |
| 96 | |
| 97 | ### External Secrets Operator (ESO) |
| 98 | |
| 99 | Syncs secrets from 30+ providers to Kubernetes Secrets. |
| 100 | |
| 101 | ```yaml |
| 102 | apiVersion: external-secrets.io/v1beta1 |
| 103 | kind: SecretStore |
| 104 | metadata: |
| 105 | name: vault-backend |
| 106 | spec: |
| 107 | provider: |
| 108 | vault: |
| 109 | server: "https://vault.example.com" |
| 110 | auth: |
| 111 | kubernetes: |
| 112 | role: "app-role" |
| 113 | ``` |
| 114 | |
| 115 | ```yaml |
| 116 | apiVersion: external-secrets.io/v1beta1 |
| 117 | kind: ExternalSecret |
| 118 | metadata: |
| 119 | name: database-credentials |
| 120 | spec: |
| 121 | refreshInterval: 1h |
| 122 | secretStoreRef: |
| 123 | name: vault-backend |
| 124 | target: |
| 125 | name: db-credentials |
| 126 | data: |
| 127 | - secretKey: password |
| 128 | remoteRef: |
| 129 | key: secret/data/database/config |
| 130 | ``` |
| 131 | |
| 132 | ### Vault Secrets Operator (VSO) |
| 133 | |
| 134 | Kubernetes-native Vault integration with automatic lease renewal. |
| 135 | |
| 136 | ```yaml |
| 137 | apiVersion: secrets.hashicorp.com/v1beta1 |
| 138 | kind: VaultDynamicSecret |
| 139 | metadata: |
| 140 | name: postgres-creds |
| 141 | spec: |
| 142 | vaultAuthRef: vault-auth |
| 143 | mount: database |
| 144 | path: creds/app-role |
| 145 | renewalPercent: 67 # Renew at 67% of TTL |
| 146 | destination: |
| 147 | name: dynamic-db-creds |
| 148 | ``` |
| 149 | |
| 150 | For ESO vs CSI vs VSO comparison, see `references/kubernetes-integration.md`. |
| 151 | |
| 152 | ## Secret Rotation Patterns |
| 153 | |
| 154 | ### Pattern 1: Versioned Static Secrets (Blue/Green) |
| 155 | |
| 156 | 1. Create new secret version in Vault |
| 157 | 2. Update staging environment |
| 158 | 3. Monitor for errors (24-48 hours) |
| 159 | 4. Gradual production rollout (10% → 50% → 100%) |
| 160 | 5. Revoke old secret (after 7 days) |
| 161 | |
| 162 | ### Pattern 2: Dynamic Database Credentials |
| 163 | |
| 164 | Vault auto-generates c |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
