| name | external-secrets |
| description | Work on shared secret delivery in the home-ops repository. Use when modifying the external-secrets platform, 1Password Connect, the `onepassword-connect` ClusterSecretStore, or non-routine app-level ExternalSecret wiring and validation patterns that depend on the shared secret delivery model. Do not use this skill for routine app edits that merely consume an unchanged Secret. |
Home Ops External Secrets
Overview
Use this skill when the shared 1Password and External Secrets model is part of the change. Keep simple app workload work in k8s-workloads, but switch here when secret-delivery semantics or platform ordering matter.
Workflow
- Read the root guide,
kubernetes/CLAUDE.md, and kubernetes/apps/external-secrets/CLAUDE.md.
- Decide whether the change is:
- platform topology or sequencing
- app-level
ExternalSecret wiring
- Load only the needed reference:
references/platform-topology.mdreferences/app-wiring.mdreferences/validation.md
- If the task also changes workload routing or backup behavior, use the dedicated networking or VolSync skill as well.
Scope Boundaries
- Use this skill when the shared 1Password and
ClusterSecretStore delivery model matters.
- All runtime secrets are delivered through this model. Bootstrap-time secrets use
op inject directly.
- If the task is mainly about secret exposure, token scope, or hardening review, use
security-review as well.
