skills.rest
ionfury
ionfuryCOMMUNITY
Explore all skills by this author →
GitHub

secrets

Automate Kubernetes secret management across ephemeral, persistent, and cross-namespace scenarios.

24|3|Updated Mar 31, 2022
Search Tags:#kubernetes#secrets#replication#external-secrets#cross-namespace#ssm#app-secrets
One-click install
npx skills add https://github.com/ionfury/homelab --skill secrets-ionfury
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secrets
Source: https://github.com/ionfury/homelab/tree/main/.claude/skills/secrets
Command: npx skills add https://github.com/ionfury/homelab --skill secrets-ionfury

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Secret management for Kubernetes homelab, enabling secure, scalable handling of ephemeral and persistent credentials across clusters and namespaces.

Core Features & Use Cases

  • secret-generator (Ephemeral, in-cluster) for auto-generating short-lived secrets without persistence.
  • ExternalSecret (Persistent, from AWS SSM) for secrets that must survive cluster rebuilds and live in cloud parameter stores.
  • app-secrets Terragrunt module (Generated + Persistent) to create JSON secrets in SSM with local backups and external pull via ESO.
  • kubernetes-replicator (Cross-Namespace) to reuse a secret across multiple namespaces.

Three-tier secret pattern example across authelia/ldap etc demonstrates how to combine all mechanisms for a single app.

Quick Start

Kick off secret management by selecting a pattern (ephemeral, persistent, or cross-namespace) and implementing it with the appropriate mechanism (secret-generator, ExternalSecret, app-secrets, or kubernetes-replicator) in your cluster.

Frequently Asked Questions about secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I manage Kubernetes secrets across multiple namespaces?▼

To manage Kubernetes secrets across multiple namespaces, you can use kubernetes-replicator to synchronize a single secret across namespaces, or ExternalSecret to pull persistent credentials from AWS SSM into specific namespaces.

What is the best way to persist Kubernetes secrets across cluster rebuilds?▼

Persisting Kubernetes secrets across cluster rebuilds requires storing them externally in cloud parameter stores like AWS SSM, then using ExternalSecret to pull and recreate them as native Kubernetes secrets inside the new cluster.

How do I auto-generate ephemeral Kubernetes secrets without persistence?▼

Auto-generating ephemeral Kubernetes secrets without persistence uses secret-generator to create short-lived, in-cluster credentials dynamically, ensuring no sensitive data remains stored after the generating resource is deleted.

Can I use AWS SSM with ExternalSecret to provision Kubernetes secrets?▼

Yes, you can use AWS SSM with ExternalSecret to provision Kubernetes secrets by defining an ExternalSecret resource that securely retrieves parameter values from SSM and syncs them into a native Kubernetes secret.

How do I combine multiple secret management patterns for a single Kubernetes app?▼

Combining multiple secret patterns for a single Kubernetes app uses a three-tier approach, layering secret-generator for ephemeral data, ExternalSecret for persistent SSM credentials, and kubernetes-replicator for cross-namespace sharing.

Do I need Terragrunt to generate and back up Kubernetes secrets in AWS SSM?▼

You need the app-secrets Terragrunt module to generate JSON secrets, store them persistently in AWS SSM with local backups, and enable external retrieval by ExternalSecret within your Kubernetes cluster.

Related Skills

engineers-hub-ltd-in-house-projectengineers-hub-ltd-in-house-project

environment-management

Manage multi-environment configurations with TypeScript and Terraform.

Official
Advanced
david-driscolldavid-driscoll
1

secrets

Select Kubernetes secret provisioning mechanisms in a Flux GitOps environment.

Community
Intermediate
asanexampleasanexample
1

terragrunt-units

Create and manage Terragrunt unit files for OpenTofu and Terragrunt platforms.

Official
Intermediate
ncsound919ncsound919

deploy-k8s

Deploy Kubernetes services with validated manifests and rollback support.

Community
Intermediate