메뉴
Use when encrypting secrets with SOPS/age, managing Kubernetes Secret manifests, rotating credentials, or setting up secret delivery (sops-nix, sealed secrets). Not for application code that reads env vars or auth tokens at runtime.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | secrets-management |
| description | Use when encrypting secrets with SOPS/age, managing Kubernetes Secret manifests, rotating credentials, or setting up secret delivery (sops-nix, sealed secrets). Not for application code that reads env vars or auth tokens at runtime. |
| allowed-tools | Bash, Read, Grep, Glob |
| injectable | true |
Protect credentials throughout their lifecycle: generation, storage, deployment, rotation, and revocation.
CRITICAL: Never commit plaintext secrets to Git. Encrypted or external, no exceptions. If you accidentally commit plaintext, rotate immediately — deleting the commit is not enough; history is the problem.
IMPORTANT: Rotate after any team member departure, system compromise, or breach. Assume the secret is known; act accordingly.
| Rule | Detail |
|---|---|
| SOPS for file-level encryption | GitOps-friendly — encrypted files live in Git |
.sops.yaml at repo root | Path patterns mapped to age key recipients |
| Encrypt values, not keys | Diffs remain reviewable — you see WHICH secret changed |
| Separate keys per environment | Dev key cannot decrypt prod |
| Runtime secrets via env vars | Never baked into container images |
.sops.yamlcreation_rules:
- path_regex: clusters/prod/.*\.secret\.yaml$
age: age1prod...
- path_regex: clusters/dev/.*\.secret\.yaml$
age: age1dev...
stringData:
db-password: ENC[AES256_GCM,data:...,type:str] # value encrypted
api-token: ENC[AES256_GCM,data:...,type:str] # keys stay readable
| Task | Command |
|---|---|
| Encrypt in place | sops encrypt -i <file> |
| Decrypt to stdout | sops decrypt <file> |
| Edit encrypted file | sops edit <file> |
| Rotate data key | sops rotate -i <file> |
| Update recipients | sops updatekeys <file> |
Never encrypt from /tmp/ — always write to the correct repo path then sops -e --in-place.
age-keygen -o key.txt — generate age keypair.sops.yaml with path rules and public keysops encrypt -i secret.yaml — encrypt in placesops updatekeys then sops rotate -i (both needed when removing a recipient)--sops-age-secret controller flag (Flux 2.7+) for global decryption| Don't | Why |
|---|---|
Secrets in Dockerfile ENV/ARG | Visible in docker history |
Commit .env files | Plaintext in repository history forever |
| Share secrets across environments | Breach in dev becomes breach in prod |
| base64 as "encryption" | K8s Secrets are base64-encoded, not encrypted |
| Never-rotated tokens | Assume eventual compromise — rotate proactively |
| No secret scanning | Run gitleaks in pre-commit to catch plaintext early |
Use when asked to document work, record decisions, create session records, write ADRs or RFCs, or update knowledge notes in ~/knowledge. Also use when confused about who a person is, what a company is, what situation the user is referring to, or any personal or professional context — read the vault before asking.
Use when creating or editing notes in an Obsidian vault, writing to ~/knowledge, or using Obsidian-specific syntax (wikilinks, callouts, embeds, frontmatter properties).
Use when reviewing any implementation. Replaces fixed spec+quality two-step with category-driven parallel specialists: an assessor picks relevant categories for the specific artifact, one specialist per category reviews in parallel, controller aggregates. Use after implementer completes a task in subagent-driven-development.
Use when dispatching work to background agents, defining custom subagents, or choosing between local agent dispatch and VM-based workers (claude-ctl).
Use when working with Kubernetes clusters, GitOps deployments, Flux reconciliation, Helm releases, or cluster troubleshooting. Guides declarative cluster management and GitOps workflows. Not for secrets encryption or SOPS operations — route those to secrets-management.
Use when sending a notification to ntfy from a homelab service, loop, or agent. Covers the canonical in-cluster publish pattern and the silent-failure trap of posting to the Authentik-gated public URL.