skills.rest
masermediagroup-stack
masermediagroup-stackCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

managing-secrets

Configure secret storage, rotation, and Kubernetes delivery using Vault and cloud secret managers.

1|Updated Feb 24, 2026
Search Tags:#security#kubernetes#secrets management#vault#external secrets operator#gitleaks#secret rotation
One-click install
npx skills add https://github.com/masermediagroup-stack/maser-media --skill managing-secrets-masermediagroup-stack
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: managing-secrets
Source: https://github.com/masermediagroup-stack/maser-media/tree/main/.cursor/skills/community/ai-design-components/skills/secret-management
Command: npx skills add https://github.com/masermediagroup-stack/maser-media --skill managing-secrets-masermediagroup-stack

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Teams leak API keys and database credentials into Git, run static secrets that never rotate, and struggle to deliver secrets securely to Kubernetes workloads, creating breach risk and compliance gaps. ## Core Features & Use Cases - Secret Store Selection & Setup: Decision frameworks for choosing HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager, or Azure Key Vault, with an automated setup script for Kubernetes, Docker, or local environments. - Kubernetes Secret Delivery: Configurations for External Secrets Operator, Secrets Store CSI Driver, and Vault Secrets Operator to sync or mount secrets into pods. - Rotation & Dynamic Secrets: Patterns for versioned static secret rotation, dynamic database credentials with short TTLs, and TLS certificate renewal via cert-manager and Vault PKI. - Leak Detection & Remediation: Gitleaks pre-commit hooks, CI/CD scanning workflows, and a step-by-step incident response process for leaked credentials. - Use Case: A platform team needs database credentials that expire hourly instead of a shared password in a ConfigMap; this Skill configures Vault's database engine and a VaultDynamicSecret so pods receive auto-renewing credentials. ## Quick Start Ask the agent to set up Vault with External Secrets Operator on your Kubernetes cluster and add a Gitleaks pre-commit hook to block secrets from being committed.

Frequently Asked Questions about managing-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I sync secrets from Vault to Kubernetes?▼

Use External Secrets Operator to sync Vault secrets into Kubernetes Secrets by defining a SecretStore pointing at your Vault server and an ExternalSecret mapping remote keys. For Vault-specific dynamic secrets, the Vault Secrets Operator handles automatic lease renewal.

External Secrets Operator vs Secrets Store CSI Driver: which should I use?▼

External Secrets Operator creates native Kubernetes Secrets and supports 30+ providers with polling-based refresh. The CSI Driver mounts secrets as files with watch-based rotation and no pod restart, suiting file-based delivery and frequent TLS rotation.

How do I rotate database credentials automatically with Vault?▼

Enable Vault's database secrets engine, configure the database connection, and create a role with a short TTL such as one hour. Applications fetch credentials from database/creds/<role> and Vault renews or revokes leases automatically.

How do I prevent secrets from being committed to Git?▼

Install Gitleaks as a pre-commit hook running gitleaks protect --staged to block commits containing secrets. Add CI/CD scanning with the Gitleaks GitHub Action and maintain a .gitleaks.toml allowlist for test keys and examples.

What should I do when a secret is leaked to GitHub?▼

Rotate the secret within one hour, revoke it at the provider, then remove it from Git history using BFG Repo-Cleaner or git-filter-repo and force push. Audit access logs for the leak window and document the incident.

When should I use dynamic secrets instead of static secrets?▼

Use dynamic secrets for database credentials, cloud IAM, SSH access, and TLS certificates where Vault can generate short-lived credentials on demand. Static KV secrets remain appropriate for third-party API keys that providers cannot auto-generate.

Related Skills

Explore More Software Engineering Skills→
pedronauckpedronauck
601

devops-engineer

Generates Dockerfiles, CI/CD pipelines, Kubernetes manifests, and Terraform infrastructure configurations.

Community
Advanced
somachaksomachak

auditing-secrets-and-config

Audit code, configuration, and CI/CD pipelines for exposed secrets.

Community
Intermediate
raphaelmansuyraphaelmansuy
2

security-rbac-auth

Implement JWT, API keys, OAuth, RBAC, and data protection for AgentStack.

Community
Advanced
keiretsu-labskeiretsu-labs
9

SOPS Credentials

Document SOPS-encrypted secrets management with FluxCD for Kubernetes.

Official
Intermediate