skills.rest
cogni-dao
cogni-daoOFFICIAL
Explore all skills by this author →
WebsiteGitHub

cicd-secrets-expert

Guide OpenBao+ESO and GitHub environment secrets for node-template deployments.

4|5|Updated Nov 5, 2025
Search Tags:#secrets#rotation#eso#openbao#externalsecret#secrets-catalog
One-click install
npx skills add https://github.com/cogni-dao/cogni --skill cicd-secrets-expert
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cicd-secrets-expert
Source: https://github.com/cogni-dao/cogni/tree/main/.claude/skills/cicd-secrets-expert
Command: npx skills add https://github.com/cogni-dao/cogni --skill cicd-secrets-expert

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This reference provides guidance for secrets architecture in node-template deployments, clarifying when to use OpenBao+ESO vs GitHub environment secrets and how to apply the correct write/rotate/add flows to keep credentials safe and consistent.

Core Features & Use Cases

  • Decision framework for choosing between Open Bao/ESO and GitHub env secrets based on custody and workload.
  • Catalog-led workflow guidance for creating and maintaining per-env and per-node secret catalogs and the loader scripts that consume them.
  • Operational patterns for adding, rotating, and debugging ExternalSecret, writer-role login, and per-node vs per-env routing across substrate and Compose infra.
  • Real-world scenarios including node onboarding, secret rotation events, and integrating with per-node catalogs and infra catalogs (paths like nodes/<node>/.cogni/secrets-catalog.yaml and infra/secrets-catalog.yaml).

Quick Start

Review the canonical secret workflow patterns in this reference and apply the OpenBao+ESO vs GitHub env decision logic to your node-template secret strategy.

Frequently Asked Questions about cicd-secrets-expert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I manage secrets for node-template deployments across different infrastructure types?▼

To manage secrets for node-template deployments, you must distinguish between OpenBao+ESO for dynamic workloads and GitHub environment secrets for simpler custody. This decision framework ensures credentials remain safe and consistent across substrate and Compose infrastructures.

When should I use OpenBao and External Secrets Operator versus GitHub environment secrets?▼

Use OpenBao and External Secrets Operator (ESO) when you need dynamic secret rotation and centralized custody across workloads. Choose GitHub environment secrets for simpler, static configurations where per-environment routing is sufficient.

How do I rotate secrets and debug ExternalSecret login flows in a per-node architecture?▼

Rotate secrets and debug ExternalSecret login flows by checking the writer-role configurations and verifying per-node catalog paths like nodes/<node>/.cogni/secrets-catalog.yaml. The catalog-led workflow guides the loader scripts that consume these updated credentials.

What is the YAML secrets-catalog format and how do loader scripts consume it?▼

The YAML secrets-catalog format defines per-env and per-node credentials structured for automated consumption. Loader scripts read these catalog files to inject secrets into substrate and Compose deployments during node onboarding or rotation events.

Why is my per-node secret routing not working correctly across substrate and Compose infrastructure?▼

Per-node secret routing fails when the secrets-catalog.yaml paths are misconfigured or the writer-role lacks permissions. Evaluate your per-node versus per-env routing logic to ensure the ExternalSecret correctly targets the specific node infrastructure.

Do I need a separate secret catalog for each node and environment?▼

You need separate secret catalogs for each node and environment to ensure proper isolation and routing. The architecture supports both per-node paths like nodes/<node>/.cogni/secrets-catalog.yaml and broader infra/secrets-catalog.yaml for environment-level configs.

Related Skills

Explore More Software Engineering Skills→
emilneuraz-aiemilneuraz-ai

prometheus-configuration

Configures Prometheus for metric collection, alerting, and monitoring across Kubernetes, Docker Compose, and bare-metal.

Community
Advanced
Patasse97Patasse97

secrets-vault-manager

Automate HashiCorp Vault secret infrastructure management with Python scripts.

Community
Advanced
terrylicaterrylica
62

doppler-secret-validation

Validate Doppler secrets and test authentication against target services.

Community
Advanced
coreymaypraycoreymaypray
1

backend-infrastructure

Automate backend infrastructure provisioning and deployment across Supabase, Vercel, and Apple platforms.

Community
Advanced