<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud Secrets Management — API Reference

## HashiCorp Vault CLI

```bash
# Enable KV secrets engine
vault secrets enable -path=secret kv-v2

# Write secret
vault kv put secret/myapp/config db_password="value" api_key="value"

# Read secret
vault kv get -format=json secret/myapp/config

# List secrets
vault kv list secret/myapp/

# Enable K8s auth
vault auth enable kubernetes
vault write auth/kubernetes/config kubernetes_host="https://K8S_HOST:443"

# Create policy
vault policy write POLICY_NAME policy.hcl

# Create K8s role
vault write auth/kubernetes/role/ROLE \
  bound_service_account_names=SA \
  bound_service_account_namespaces=NS \
  policies=POLICY \
  ttl=1h
```

## AWS Secrets Manager CLI

```bash
# Create secret
aws secretsmanager create-secret --name NAME --secret-string 'VALUE'

# Get secret
aws secretsmanager get-secret-value --secret-id NAME

# List secrets
aws secretsmanager list-secrets --output json

# Rotate secret
aws secretsmanager rotate-secret --secret-id NAME \
  --rotation-lambda-arn ARN --rotation-rules AutomaticallyAfterDays=30

# Delete secret
aws secretsmanager delete-secret --secret-id NAME --force-delete-without-recovery
```

## GCP Secret Manager

```bash
# Create secret
echo -n "value" | gcloud secrets create SECRET_NAME --data-file=-

# Access secret
gcloud secrets versions access latest --secret=SECRET_NAME

# List secrets
gcloud secrets list --format=json

# Add IAM binding
gcloud secrets add-iam-policy-binding SECRET_NAME \
  --member="serviceAccount:SA@PROJECT.iam.gserviceaccount.com" \
  --role="roles/secretmanager.secretAccessor"
```

## Kubernetes Secret Store CSI

```bash
# Install CSI driver
helm install csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver \
  -n kube-system

# List SecretProviderClasses
kubectl get secretproviderclass -A

# Check mounted secrets
kubectl get secretproviderclasspodstatus -A
```

## External Secrets Operator

```bash
# Install ESO
helm install external-secrets external-secrets/external-secrets -n external-secrets --create-namespace

# List ExternalSecrets
kubectl get externalsecrets -A

# Check sync status
kubectl get externalsecrets -A -o json | jq '.items[].status.conditions'

# List ClusterSecretStores
kubectl get clustersecretstores
```
