菜单
Encrypt a Kubernetes Secret with SOPS for clusters/prod. MUST run on uap-home-1 (sops is absent on Windows; the age private key lives only there). Use when adding/rotating any secret.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Run long or multi-checkpoint repository work through Hermes Kanban with autonomous OpenAI author/reviewer routing.
Take a routine on-demand k3s etcd snapshot and confirm it reached offsite R2. Non-destructive. Use for ad-hoc backups. RESTORE is NOT covered here (it is destructive + owner-gated).
Commit a change and get it pushed. The git origin + write deploy key live ONLY on uap-ops-1 (100.82.241.121), NOT the workstation. Use whenever a change is ready to land.
Deploy a change to the cluster via Flux GitOps and VERIFY it actually reconciled. Use after editing anything under clusters/prod. A push alone is NOT a verified deploy.
Offload a token-HEAVY, quote-verifiable read (big log/doc/corpus) to the free local LLM so the big input never enters this paid context. Use when you are about to read a large file only to extract/locate/enumerate specific facts. NOT for judgment, synthesis, code edits, or small inputs.
Run the UAP validation gate (tests/verify-local.ps1) and interpret its result. Use before handing any change back, and before any commit/push. Knows the success tokens and which failures are EXPECTED on the Windows workstation.
| name | uap-sops-encrypt |
| description | Encrypt a Kubernetes Secret with SOPS for clusters/prod. MUST run on uap-home-1 (sops is absent on Windows; the age private key lives only there). Use when adding/rotating any secret. |
uap-home-1 (100.106.223.120), where sops is installed. Encryption uses the public age recipient below; the private key on uap-home-1 is needed only to decrypt and verify. Windows can edit ciphertext but has no sops installation..sops.yaml path_regex: it must live under clusters/prod/ and be named *.sops.yaml (or *.sops.yml). Files outside clusters/prod/ are NOT auto-encrypted.data: or stringData: only — .sops.yaml encrypted_regex is ^(data|stringData)$. A secret under any other key is left plaintext by design.age1ellxh9rynjv2n2sau9mekpt3qmt7r9w7t7zqjj6plx3nd2d0cg9sys9s85.sops --encrypt --in-place clusters/prod/.../<name>.sops.yaml.sops: block and ENC[AES256_GCM... values.shred -u <tmp>); never leave plaintext on disk or in shell history.clusters/prod/infra/kustomization.yaml so Flux applies it.SOPS_AGE_KEY_FILE=/home/uap/.config/sops/age/keys.txt sops --decrypt clusters/prod/.../<name>.sops.yaml >/dev/null.Never paste a secret value into a prompt, log, markdown, or commit message.
Authoritative reference: infra/sops/README.md, .sops.yaml, runbooks/gitops-flux-sops.md.