secrets

Manage Goldsky pipeline sink secrets via interactive CLI workflows.

8|Updated Feb 26, 2026
One-click install
npx skills add https://github.com/goldsky-io/goldsky-agent --skill secrets-goldsky-io
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: secrets
Source: https://github.com/goldsky-io/goldsky-agent/tree/main/skills/secrets
Command: npx skills add https://github.com/goldsky-io/goldsky-agent --skill secrets-goldsky-io

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jq, and includes scripts (resource) components.

What problem does it solve?

Goldsky secrets management solves the challenge of securely storing and rotating credentials used by pipeline sinks (PostgreSQL, ClickHouse, Kafka, S3, etc.), avoiding hard-coded secrets in YAML and enabling safe deployment.

Core Features & Use Cases

  • Create, rotate, list, update, and reference secrets for multiple sinks (databases, queues, object storage, search).
  • Validate secret values against JSON schemas located in the schemas/ folder to ensure correct structure and safety.
  • Seamlessly integrate secrets into pipelines by referencing secret names in YAML for secure connections.

Quick Start

Run the Goldsky CLI to create a new secret and reference it in your pipeline YAML.

Frequently Asked Questions about secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I securely manage pipeline credentials for PostgreSQL and Kafka sinks?

Pipeline credentials for PostgreSQL and Kafka sinks are managed by creating, rotating, and referencing named secrets. This avoids hard-coded credentials in YAML files and ensures safe deployment by validating secret structures against JSON schemas.

What's the best way to rotate secrets for a Goldsky pipeline sink?

Rotating secrets for a Goldsky pipeline sink involves using interactive CLI workflows to update the stored credential values. This ensures your pipeline connections to databases and object storage remain secure without requiring YAML modifications.

Can I reference secret names directly in my pipeline YAML configuration?

Yes, you can reference secret names directly in your pipeline YAML configuration. This mechanism allows pipelines to securely connect to sinks like ClickHouse, S3, and PostgreSQL by resolving the referenced secret at runtime.

How are connection strings parsed for different database sinks?

Connection strings for database sinks are parsed using a dedicated scripts folder equipped with jq. This setup extracts and validates the necessary credential components from the connection strings before secure storage.

Do I need jq installed to validate and create pipeline secrets?

Yes, jq is required as a dependency to parse connection strings and validate secret values. The scripts component utilizes jq to ensure the correct structure and safety of credentials before storing them for your sinks.

When should I use dedicated secret management instead of hard-coding values in YAML?

Dedicated secret management should be used whenever you need to securely store and rotate credentials for pipeline sinks like PostgreSQL, Kafka, or S3. It prevents hard-coded secrets in YAML, enabling safe deployment and structured validation.