skills.rest
gilesknap
gilesknapCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

sealed-secrets

Generate and manage sealed-secret YAMLs for Kubernetes GitOps workflows.

32|5|Updated Oct 6, 2024
Search Tags:#security#kubernetes#gitops#secrets-management#rotation#sealed-secrets#kubeseal
One-click install
npx skills add https://github.com/gilesknap/tpi-k3s-ansible --skill sealed-secrets
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sealed-secrets
Source: https://github.com/gilesknap/tpi-k3s-ansible/tree/main/.claude/skills/sealed-secrets
Command: npx skills add https://github.com/gilesknap/tpi-k3s-ansible --skill sealed-secrets

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Handling sensitive data in GitOps workflows is risky when secrets are stored in plaintext. This skill guides sealing, rotating, and troubleshooting Kubernetes secrets using SealedSecrets so secrets can be committed safely and applied to clusters.

Core Features & Use Cases

  • Sealing secrets with kubeseal to produce *-secret.yaml files that the cluster can decrypt in-place.
  • Rotation and resealing workflows, including using seal-argocd-dex subcommands to refresh credentials without exposing plaintext values.
  • Safeguards around file naming, particularly avoiding placeholder base64 values that would cause runtime failures.

Quick Start

Seal a new secret with kubeseal to produce a *-secret.yaml, commit it, and ensure the sealed secret is deployed after resealing.

Frequently Asked Questions about sealed-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely store Kubernetes secrets in a GitOps repository?▼

Sealed secrets encrypt sensitive data at rest using kubeseal, producing encrypted YAML files that can be safely committed to GitOps repositories and decrypted in-place by the cluster.

How do I rotate and re-seal Kubernetes secrets without exposing plaintext values?▼

Rotate and re-seal Kubernetes secrets using integrated seal-argocd-dex subcommands, which refresh credentials and generate new sealed-secret YAMLs without exposing plaintext values during the workflow.

Does sealed-secrets work with K3s clusters for GitOps deployments?▼

Sealed secrets work with K3s clusters and general Kubernetes environments, supporting GitOps workflows by managing sealed-secret YAMLs across different cluster configurations for secure deployments.

Why do my Kubernetes sealed secrets fail after resealing with placeholder base64 values?▼

Sealed secrets fail when placeholder base64 values are left in the YAML files, so enforcing proper file naming and validating the secret data prevents runtime failures during deployment.

Do I need to restart pods after resealing Kubernetes secrets to keep workloads healthy?▼

Yes, you need to restart pods after resealing Kubernetes secrets to ensure workloads pick up the updated credentials and maintain healthy application states across the cluster.

What is the best way to manage secret rotation in a Kubernetes GitOps workflow?▼

The best way to manage secret rotation in a GitOps workflow is using kubeseal to generate sealed-secret YAMLs and dedicated tooling to refresh credentials while maintaining proper file naming conventions.

Related Skills

Explore More Software Engineering Skills→
camoneartcamoneart
5

k8s-manifest-generator

Generate Kubernetes manifests for Deployments, Services, ConfigMaps, and Secrets.

Community
Intermediate
AshleyHollisAshleyHollis

kubernetes-architect

Design scalable Kubernetes platforms and GitOps-enabled deployments for enterprise workloads.

Community
Advanced
nq-rdlnq-rdl

argo-cd

Manage ArgoCD configurations and health checks via the argocd CLI.

Official
Intermediate
ancolemanancoleman
503

managing-secrets

Manage API keys, database credentials, and certificates with HashiCorp Vault.

Community
Advanced