<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Implementing Container Secrets Management

## Vault CLI — Secret Operations
```bash
# Store secret
vault kv put secret/myapp/db username="app" password="s3cret"

# Read secret
vault kv get -format=json secret/myapp/db

# Enable Kubernetes auth
vault auth enable kubernetes
vault write auth/kubernetes/config kubernetes_host="https://kubernetes.default.svc"

# Create policy
vault policy write myapp - <<< 'path "secret/data/myapp/*" { capabilities = ["read"] }'
```

## kubectl — Secret Management
```bash
# Create secret
kubectl create secret generic myapp-db \
  --from-literal=password='s3cret' -n production

# View secret keys (not values)
kubectl get secret myapp-db -n production -o jsonpath='{.data}' | jq 'keys'

# Enable etcd encryption
kubectl get apiserver -o yaml | grep -A5 encryption
```

## kubeseal — Sealed Secrets
```bash
# Seal a secret for GitOps
kubectl create secret generic myapp-db \
  --from-literal=password='s3cret' --dry-run=client -o yaml | \
  kubeseal --format yaml > sealed-secret.yaml

# Verify sealed secret
kubeseal --validate < sealed-secret.yaml
```

## Docker — Image Secret Scanning
```bash
# Check image history for secrets
docker history --no-trunc myapp:latest | grep -iE 'password|secret|key|token'

# Use multi-stage builds to avoid secret leakage
# Build stage: use secrets
# Final stage: copy only artifacts
```
