Secret Management

Browse prompts in this category.

Prompts

1Password Secrets Automation
Configure 1Password Connect server, service accounts, op:// references, op run process-scoped injection, and the Kubernetes Operator (OnePasswordItem CRD) with least-privilege vault access. Use when automating 1Password secret retrieval.
AWS Secrets Manager and KMS Operator
Configure AWS Secrets Manager and KMS with customer-managed CMKs, encryption context, Lambda rotation, VPC interface endpoints, CloudTrail auditing, and multi-region replica secrets. Use when managing AWS-native secrets and envelope encryption.
Azure Key Vault Secrets Operator
Configure Azure Key Vault per-app/env with RBAC (not legacy access policies), managed identities/workload identity federation, Private Link, soft-delete/purge protection, Event Grid rotation, and Defender for Key Vault. Use when managing AKV.
CyberArk Conjur Secrets Operator
Configure CyberArk Conjur with policy-as-code YAML, layer/group RBAC, platform authenticators (authn-k8s/iam/azure/jwt), Secrets Provider sidecar/init patterns, follower HA, and SIEM-forwarded audit. Use when managing Conjur secrets.
Docker Secrets Operator
Configure Docker secrets across Swarm (Raft-encrypted), BuildKit --mount=type=secret, and Compose with tmpfs /run/secrets, 0400 perms, read-only rootfs, cap-drop, and zero-downtime rotation. Use when injecting secrets into Docker workloads.
Doppler Secrets Operator
Configure Doppler projects/configs with root/staging/prod inheritance, per-environment service tokens with IP allowlists, doppler run process-scoped injection, platform syncs, and SSO/SIEM integration. Use when managing Doppler secrets.
GCP Secret Manager and Cloud KMS Operator
Configure GCP Secret Manager and Cloud KMS with per-secret IAM, Workload Identity Federation, VPC Service Controls, Private Service Connect, 90-day KMS rotation, and Data Access audit logs. Use when managing GCP secrets or envelope encryption.
GitHub Actions Secrets Operator
Configure GitHub Actions secrets with environment/repo/org scoping, OIDC federation with job_workflow_ref sub claims, environment protection rules, add-mask, SHA-pinned actions, and secret scanning. Use when managing Actions secrets and OIDC trust.
HashiCorp Vault Secrets Operator
Configure HashiCorp Vault and the Vault Secrets Operator (VSO) for Kubernetes with path-scoped policies, Kubernetes auth, VaultDynamicSecret/PKI CRDs, Transit client-cache encryption, and mTLS. Use when syncing Vault secrets into K8s.
Infisical Secrets Operator
Configure Infisical workspaces with machine identities (K8s/AWS/Azure/GCP/Universal Auth), E2EE, infisical run injection, InfisicalSecret CRD, native DB credential rotation, and approval workflows. Use when managing Infisical secrets.
Kubernetes External Secrets Operator
Configure Kubernetes External Secrets Operator (ESO) with namespace-scoped SecretStores, workload-identity provider auth, Kyverno/Gatekeeper remoteRef allowlists, cert-manager webhook TLS, and default-deny egress. Use when syncing external secrets into K8s.
Kubernetes Secrets Operator
Harden native Kubernetes Secrets with KMS EncryptionConfiguration, resourceName-scoped RBAC, volume-mount injection (not env vars), immutable secrets, CSI Secret Store Driver, and Falco audit monitoring. Use when managing core K8s Secrets.
Mozilla SOPS Secrets Operator
Configure Mozilla SOPS with AWS/GCP/Azure KMS, age, or PGP providers, .sops.yaml path_regex rules, pre-commit hooks, Flux/ArgoCD GitOps decryption via workload identity, and sops updatekeys rotation. Use when encrypting secrets in git.
Vercel Secrets Operator
Configure Vercel environment variables with context-scoped Sensitive flags, no NEXT_PUBLIC_ for secrets, server-only framework access (Next/Nuxt/Remix/SvelteKit/Astro), OIDC federation, and preview/prod token separation. Use when managing Vercel secrets.