---
id: w4/m1/t002
title: Secret bootstrap script: k8s Secrets from `.env`, never committed
worker: worker4
status: done
estimate: 25m
depends_on: [w4/m1/t001]
---

## Objective

A script that reads the repo-local `.env` (gitignored) and creates the Kubernetes Secrets Kratos and Hydra need — DSNs pointing at the CNPG clusters, Kratos cookie/cipher secrets, Hydra system + OIDC-pairwise-salt secrets — out-of-band, so no secret material ever lands in git or in Argo-managed manifests.

## Context

- Repo rule: never commit or print `.env` contents; treat like `infra/local/bex.kubeconfig`.
- GitOps README mandates SOPS/sealed-secrets for committed secrets — this script is the local out-of-band path; prod-grade encryption stays with w1/m7 t003.
- CNPG already generates DB credential Secrets (t001); the script composes DSNs from them or from `.env` keys.
- Follow the style of existing helpers in `scripts/` (e.g. `scripts/app-apply.sh`, `DRY_RUN=1` support).

## Steps

1. Add `scripts/auth-secrets.sh`: load `.env`, fail with a clear message on missing keys, `kubectl create secret generic` (with `--dry-run=client -o yaml | kubectl apply -f -` for idempotency) into the auth components' namespace.
2. Support `DRY_RUN=1` (print resource names only — never values).
3. Document required `.env` keys in the script header comment (names only).

## Files

- `scripts/auth-secrets.sh` (new)

## Acceptance criteria

- [ ] Running the script against the mock cluster creates/updates the Secrets idempotently.
- [ ] Missing `.env` keys produce a named, actionable error; no secret values are echoed.
- [ ] `git status` shows no new tracked files containing secret material.

## Out of scope

- Sealed-secrets/SOPS for committed secrets (w1/m7 t003); rotating credentials.
