القائمة
Encrypt a Kubernetes Secret with SOPS for clusters/prod. MUST run on uap-home-1 (sops is absent on Windows; the age private key lives only there). Use when adding/rotating any secret.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Run long or multi-checkpoint repository work through Hermes Kanban with autonomous OpenAI author/reviewer routing.
Take a routine on-demand k3s etcd snapshot and confirm it reached offsite R2. Non-destructive. Use for ad-hoc backups. RESTORE is NOT covered here (it is destructive + owner-gated).
Commit a change and get it pushed. The git origin + write deploy key live ONLY on uap-ops-1 (100.82.241.121), NOT the workstation. Use whenever a change is ready to land.
Deploy a change to the cluster via Flux GitOps and VERIFY it actually reconciled. Use after editing anything under clusters/prod. A push alone is NOT a verified deploy.
Offload a token-HEAVY, quote-verifiable read (big log/doc/corpus) to the free local LLM so the big input never enters this paid context. Use when you are about to read a large file only to extract/locate/enumerate specific facts. NOT for judgment, synthesis, code edits, or small inputs.
Run the UAP validation gate (tests/verify-local.ps1) and interpret its result. Use before handing any change back, and before any commit/push. Knows the success tokens and which failures are EXPECTED on the Windows workstation.
| name | uap-sops-encrypt |
| description | Encrypt a Kubernetes Secret with SOPS for clusters/prod. MUST run on uap-home-1 (sops is absent on Windows; the age private key lives only there). Use when adding/rotating any secret. |
uap-home-1 (100.106.223.120), where sops is installed. Encryption uses the public age recipient below; the private key on uap-home-1 is needed only to decrypt and verify. Windows can edit ciphertext but has no sops installation..sops.yaml path_regex: it must live under clusters/prod/ and be named *.sops.yaml (or *.sops.yml). Files outside clusters/prod/ are NOT auto-encrypted.data: or stringData: only — .sops.yaml encrypted_regex is ^(data|stringData)$. A secret under any other key is left plaintext by design.age1ellxh9rynjv2n2sau9mekpt3qmt7r9w7t7zqjj6plx3nd2d0cg9sys9s85.sops --encrypt --in-place clusters/prod/.../<name>.sops.yaml.sops: block and ENC[AES256_GCM... values.shred -u <tmp>); never leave plaintext on disk or in shell history.clusters/prod/infra/kustomization.yaml so Flux applies it.SOPS_AGE_KEY_FILE=/home/uap/.config/sops/age/keys.txt sops --decrypt clusters/prod/.../<name>.sops.yaml >/dev/null.Never paste a secret value into a prompt, log, markdown, or commit message.
Authoritative reference: infra/sops/README.md, .sops.yaml, runbooks/gitops-flux-sops.md.