Manage Secrets — Secret Lifecycle Manager

UNBREAKABLE RULE: All secret operations go through scripts/sync-secrets.mjs. Never kubectl create/patch secret directly. Never gh secret set directly. This skill is the ONLY way to manage secrets.

When to Use

Trigger on ANY of these:

• "sync secrets", "push secret", "fix secret", "verify secrets"
• "API key", "token", "credential", "401", "authentication error", "invalid key"
• Any mention of .env.local, .secrets, fenrir-app-secrets, agent-secrets
• Any Anthropic/Stripe/Google key issue
• Deploy failures caused by bad secret values
• "manage secrets", "/manage-secrets"

Commands

/manage-secrets                    # Audit all secrets
/manage-secrets sync               # Sync missing secrets to correct destinations
/manage-secrets fix-all            # Re-sync ALL secrets with clean values
/manage-secrets verify             # Byte-level compare K8s vs local
/manage-secrets push <KEY>         # Force-push one secret everywhere + restart
/manage-secrets restart            # Restart fenrir-app to pick up changes

Instructions

Parse the command

Execute

REPO_ROOT=$(git rev-parse --show-toplevel)
node "$REPO_ROOT/scripts/sync-secrets.mjs" <flag>

Secret Sources

Destinations

n8n Secrets Manifest

n8n-secrets in fenrir-marketing namespace — referenced by n8n Helm values via secretRefs.existingSecret.

To provision n8n-secrets after deploy:

/manage-secrets sync   # pushes all k8s-n8n entries from .env.local → analytics namespace

Common Scenarios

Secret 401 error in production:

/manage-secrets verify         # Find the mismatch
/manage-secrets push FENRIR_ANTHROPIC_API_KEY  # Fix it everywhere + restart

After rotating a key:

1. Update the value in .env.local or .secrets
2. /manage-secrets push <KEY_NAME>

After a deploy overwrites a manual fix:

/manage-secrets fix-all        # Re-sync everything from local files

Routine health check:

/manage-secrets verify         # Compare K8s values against local

Rules

• NEVER use kubectl create/patch secret directly — always go through this script
• NEVER use gh secret set directly — always go through this script
• NEVER ask the user to paste secrets — read from .env.local or .secrets
• The script strips quotes and whitespace automatically
• --push auto-restarts the deployment — no need to restart separately
• After ANY secret change, always --verify to confirm it took effect