feat: secrets management skill by agaetep · Pull Request #60 · linuxfoundation/lfx-skills

agaetep · 2026-06-05T20:36:01Z

Adds a new Claude Code skill lfx-v2-secrets/SKILL.md that guides an agent through wiring up secrets for LFX V2 services using External Secrets Operator + IRSA on AWS.

Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

Copilot

Pull request overview

Adds a new lfx-v2-secrets skill documenting the standard workflow for managing LFX V2 microservice secrets via External Secrets Operator (ESO) + IRSA on AWS, covering both full initial setup and incremental secret additions.

Changes:

Introduces a new lfx-v2-secrets/SKILL.md with two operational modes (new service vs. existing service).
Documents end-to-end steps spanning lfx-v2-opentofu, lfx-secrets-management, service Helm chart changes, and lfx-v2-argocd.
Provides templates, verification checklists, and common troubleshooting workflows.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 5 comments.

+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken | default true }}


+
+Ask the user to collect:
+
+1. **Service name** — fully qualified name (e.g., `lfx-v2-invite-service`, `lfx-v2-email-service`)


+|------|-------|
+| AWS Region | `us-west-2` |
+| K8s Secret name | `lfx-v2-<service>-secrets` (e.g., `lfx-v2-invite-service-secrets`) |
+| SecretStore name | `{{ .Chart.Name }}` |


+        conversionStrategy: Default
+        decodingStrategy: None
+        tags:
+          service-lfx-v2-<service>: enabled


+>
+> - Each secret in the lfx-secrets-management source becomes a separate AWS SM path entry
+> - The `path` convention is `cloud/<service-short-name>/<secret-group>`
+> - Use the `environments` list to sync to all three environments in parallel


detjensrobert

Looks good!

detjensrobert · 2026-06-05T21:06:49Z

+> **Important**: All secrets must be stored as JSON in AWS SM, even single-field ones.
+> Two equivalent ways to express this:
+>
+> ```yaml
+> # implicit JSON (list form)
+> fields:
+>   - <field_name>
+>
+> # explicit JSON (scalar + flag)
+> fields: <field_name>
+> store_as_json: true
+> ```


Is this a new requirement from AWS SM? I don't remember this being a restriction for previous secrets.

This is a kubernetes ESO requirement, based on how we use dataFrom to pull secrets into a single secret store. A single string without a key causes errors in the secret store pull

Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 8 comments.

+  whenever someone says "set up secrets", "wire up ESO", "add a secret to this service",
+  "IRSA configuration", "External Secrets for V2", or any mention of AWS Secrets Manager
+  integration with Kubernetes for LFX V2 services.
+allowed-tools: Bash, Read, Glob, Grep, AskUserQuestion, WebFetch


+  automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken | default true }}
+{{- end }}


+        tags:
+          service-lfx-v2-<service>: enabled


+> **Tag-based discovery**: ESO finds and merges all AWS SM secrets tagged
+> `service-lfx-v2-<service>: enabled` into a single Kubernetes Secret named
+> `lfx-v2-<service>-secrets`. No manual `data` list is needed — new secrets are picked up


+|------|-------|
+| AWS Region | `us-west-2` |
+| K8s Secret name | `lfx-v2-<service>-secrets` (e.g., `lfx-v2-invite-service-secrets`) |
+| SecretStore name | `{{ .Chart.Name }}` |


+
+Then ask the user to collect:
+
+1. **Service name** — fully qualified name (e.g., `lfx-v2-invite-service`, `lfx-v2-email-service`)


+| IAM account — staging | `844790888233` |
+| IAM account — prod | `372256339901` |
+| IRSA role ARN pattern | `arn:aws:iam::<account-id>:role/lfx-v2-<service>` |
+| AWS SM path pattern | `cloud/<3rd-party-service>/<name_or_identifier>` |


+```yaml
+<Secret Name>:
+  tags: [auth0, <service_tag>]
+  envs: [development, staging, production]


Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 6 comments.

+---
+name: lfx-v2-secrets
+description: >
+  Guide an agent through wiring up secrets for LFX V2 microservices using External Secrets
+  Operator (ESO) + IRSA. Supports two modes: (1) full setup for new services touching


+  whenever someone says "set up secrets", "wire up ESO", "add a secret to this service",
+  "IRSA configuration", "External Secrets for V2", or any mention of AWS Secrets Manager
+  integration with Kubernetes for LFX V2 services.
+allowed-tools: Bash, Read, Glob, Grep, AskUserQuestion, WebFetch


Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 6 comments.

+---
+name: lfx-v2-secrets
+description: >
+  Guide an agent through wiring up secrets for LFX V2 microservices using External Secrets
+  Operator (ESO) + IRSA. Supports two modes: (1) full setup for new services touching
+  lfx-v2-opentofu, lfx-secrets-management, the service Helm chart, and lfx-v2-argocd;
+  (2) adding secrets to existing services already configured with ESO. Use this skill
+  whenever someone says "set up secrets", "wire up ESO", "add a secret to this service",
+  "IRSA configuration", "External Secrets for V2", or any mention of AWS Secrets Manager
+  integration with Kubernetes for LFX V2 services.
+allowed-tools: Bash, Read, Glob, Grep, AskUserQuestion, WebFetch
+---


+<Secret Name>:
+  tags: [lfx_v2, <service_tag>, <type_tag>]
+  environments: [development, staging, production]
+  source:
+    onepassword:


+    - aws_secretsmanager:
+        tags:
+          service: pcc
+        path: cloud/supabase/api_key


+metadata:
+  name: {{ .Values.serviceAccount.name | default .Chart.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ .Chart.Name }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken | default true }}
+{{- end }}


+        tags:
+          service-lfx-v2-<service>: enabled
+      rewrite:


+> **Tag-based discovery**: ESO finds and merges all AWS SM secrets tagged
+> `service-lfx-v2-<service>: enabled` into a single Kubernetes Secret named
+> `lfx-v2-<service>-secrets`. No manual `data` list is needed — new secrets are picked up
+> automatically after the next sync.


Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 6 comments.

+2. ESO's **SecretStore** uses that ServiceAccount's JWT token to authenticate to AWS
+3. ESO watches **ExternalSecret** manifests and syncs matching secrets from AWS SM into K8s Secrets
+4. Application deployments reference the K8s Secret via environment variable or volume mount
+5. Local development skips ESO entirely and injects secret values directly via `environment` in values


+
+Then ask the user to collect:
+
+1. **Service name** — fully qualified name (e.g., `lfx-v2-invite-service`, `lfx-v2-email-service`)


+**1Password example:**
+
+```text
+Service: lfx-v2-invite-service


+`auth0` (client_secret, simpler M2M or BFF clients):
+
+```text
+Service: lfx-v2-invite-service


+`auth0_jwt` (JWT private key, standard for LFX V2 microservices):
+
+```text
+Service: lfx-v2-invite-service


+> - Each secret in the lfx-secrets-management source becomes a separate AWS SM path entry
+> - The `path` convention is `cloud/<service-short-name>/<secret-group>`
+> - Use the `envs` list to sync to all three environments in parallel


Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

+>
+> - Each secret becomes a separate AWS SM path entry
+> - The `path` must include the service name: `<3rd-party-service>/<service>` (e.g., `atlassian/lfx-v2-committee-service`)
+> - The `tags` list must include the service tag (`eso_service_tag` from Step 2a) so the secret is identifiable by service


+In the [lfx-secrets-management](https://github.com/linuxfoundation/lfx-secrets-management) repo,
+add an entry for each secret to `secrets/lfx/<service>.yml` — one file per LFX V2 service.
+If the file doesn't exist yet, create it. If it already exists, append the new entry.


feat: secrets management skill

99367a2

Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

Copilot AI review requested due to automatic review settings June 5, 2026 20:36

Copilot started reviewing on behalf of agaetep June 5, 2026 20:36 View session

Copilot AI reviewed Jun 5, 2026

View reviewed changes

agaetep added 2 commits June 5, 2026 16:44

copilot suggestions

2a63416

Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

changes after testing skill

6a0fc59

Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

Copilot AI review requested due to automatic review settings June 5, 2026 20:52

Copilot started reviewing on behalf of agaetep June 5, 2026 20:52 View session

Copilot AI reviewed Jun 5, 2026

View reviewed changes

detjensrobert previously approved these changes Jun 5, 2026

View reviewed changes

dealako and others added 2 commits June 10, 2026 09:34

Merge branch 'main' into agaete/secrets-management

60ee2a1

examples are just examples, not options

b6e3fa8

Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

Copilot AI review requested due to automatic review settings June 15, 2026 17:49

agaetep dismissed detjensrobert’s stale review via b6e3fa8 June 15, 2026 17:49

Copilot started reviewing on behalf of agaetep June 15, 2026 17:52 View session

Copilot AI reviewed Jun 15, 2026

View reviewed changes

agaetep and others added 2 commits June 15, 2026 14:17

add note to make changes to self serve branch values

669bd03

Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

Merge branch 'main' into agaete/secrets-management

b33140d

Copilot AI review requested due to automatic review settings June 15, 2026 21:17

Copilot started reviewing on behalf of agaetep June 15, 2026 21:18 View session

Copilot AI reviewed Jun 15, 2026

View reviewed changes

agaetep added 2 commits June 15, 2026 14:39

copilot suggestions

22f3134

Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

copilot suggestions

1f8aff4

Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

Copilot AI review requested due to automatic review settings June 15, 2026 21:42

Copilot started reviewing on behalf of agaetep June 15, 2026 21:42 View session

Copilot AI reviewed Jun 15, 2026

View reviewed changes

agaetep added 2 commits June 15, 2026 14:55

more copilot suggestions

8285cd1

Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

more copilot suggestions

a27b36a

Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

Copilot AI review requested due to automatic review settings June 15, 2026 22:12

Copilot started reviewing on behalf of agaetep June 15, 2026 22:12 View session

Copilot AI reviewed Jun 15, 2026

View reviewed changes

agaetep added 2 commits June 15, 2026 15:39

check opentofu from github, clarify service names

056ebaf

Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

update skill based on new file and path naming

64f9460

Signed-off-by: Antonia Gaete <agaete@linuxfoundation.org>

Copilot AI review requested due to automatic review settings June 16, 2026 20:34

Copilot started reviewing on behalf of agaetep June 16, 2026 20:35 View session

Copilot AI reviewed Jun 16, 2026

View reviewed changes

agaetep requested a review from a team June 17, 2026 14:10


		Ask the user to collect:

		1. Service name — fully qualified name (e.g., `lfx-v2-invite-service`, `lfx-v2-email-service`)

		automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken \| default true }}
		{{- end }}


		Then ask the user to collect:

		1. Service name — fully qualified name (e.g., `lfx-v2-invite-service`, `lfx-v2-email-service`)

Conversation

agaetep commented Jun 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

detjensrobert left a comment

Choose a reason for hiding this comment

Uh oh!

detjensrobert Jun 5, 2026

Choose a reason for hiding this comment

Uh oh!

agaetep Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants