homelab/.claude/skills/regen-sealed-secret/SKILL.md

name, description, disable-model-invocation

name	description	disable-model-invocation
regen-sealed-secret	Regenerate a committed *-sealed.yaml SealedSecret from .env values. Use when rotating a secret or when a *-secret.sh script needs to be run to refresh sealed output.	true

Regenerate the sealed secret for: $ARGUMENTS

This repo keeps sealed secrets and their source script side by side (e.g. manifests/home-services/discord-bot-secret.sh → manifests/home-services/discord-bot-sealed.yaml, manifests/media/immich-postgres-secret.sh → manifests/media/immich-postgres-sealed.yaml). The script is the source of truth; the *-sealed.yaml file is generated output.

Steps

1. Find the matching *-secret.sh script for the target secret (search manifests/**/*-secret.sh). If none exists yet, model the new one on manifests/home-services/discord-bot-secret.sh:

   source "$(dirname "$0")/../../.env"
   kubectl create secret generic <name> \
     --namespace=<namespace> \
     --from-literal=<KEY>="${ENV_VAR}" \
     --dry-run=client -o yaml \
     | kubeseal --controller-namespace=kube-system \
              --controller-name=sealed-secrets-controller \
              --format=yaml \
     > "$(dirname "$0")/<name>-sealed.yaml"
   

2. Confirm the source value is up to date in .env (copy from .env.example if the key is missing, then ask the user to fill it in — never invent a secret value).
3. Confirm kubeseal can reach the cluster's controller: kubeseal --controller-namespace=kube-system --controller-name=sealed-secrets-controller --fetch-cert should succeed against the live cluster (minisforum, context default).
4. Run the script: bash manifests/<area>/<name>-secret.sh.
5. Diff the resulting *-sealed.yaml — it should be the only file that changed, and it should NOT contain plaintext (sealed secrets are ciphertext under spec.encryptedData, unlike the raw kubectl create secret ... -o yaml output piped into it).
6. Commit only the regenerated *-sealed.yaml. Never commit the raw kubectl create secret --dry-run=client -o yaml output or .env itself.

If the secret should instead be created directly in-cluster without being committed (the runtime-script pattern, e.g. authentik-secret.sh), skip kubeseal entirely and pipe straight to kubectl apply -f - — don't sealed-secret something that was never meant to be committed.