mitodl/agent-kit/vault-k8s-auth

Claude Code and agent skill by mitodl/agent-kit

Trust tier 3
  • community
Source check pending

Checking that the SKILL.md file is still in the repository.

Wire Vault Kubernetes authentication for a service using hvac. Use this skill when adding or modifying Vault auth in any Kubernetes-deployed service — always read the Vault role and mount path from environment variables, never hardcode them.

Install

npx vskill@latest install mitodl/agent-kit/vault-k8s-auth

SKILL.md

Vault Kubernetes Auth

Services on Kubernetes authenticate to Vault using the Kubernetes auth method via the hvac library. This applies to any Python service the team deploys on the cluster — not just Dagster.

Environment variables

Never hardcode the Vault role or mount path. Always read them from environment variables:

VariablePurpose
VAULT_ADDRURL of the Vault server
VAULT_ROLEVault role bound to the pod's Kubernetes service account
VAULT_K8S_MOUNTVault Kubernetes auth mount path

Example wiring:

python
import os
import hvac
vault_role = os.environ["VAULT_ROLE"]
vault_mount = os.environ["VAULT_K8S_MOUNT"]
client = hvac.Client(url=os.environ["VAULT_ADDR"])
client.auth.kubernetes.login(
    role=vault_role,
    jwt=_read_service_account_token(),
    mount_point=vault_mount,
)

Kubernetes RBAC / auth binding

Use the OLEKSAuthBinding component to bind the pod's Kubernetes service account to the Vault role. This component handles the Vault policy and role configuration.

Helm / pod spec

Inject the variables via Helm values for each service's deployment:

yaml
env:
  - name: VAULT_ROLE
    value: "<service-name>-role"
  - name: VAULT_K8S_MOUNT
    value: "<mount-path>"
  - name: VAULT_ADDR
    valueFrom:
      secretKeyRef:
        name: vault-config
        key: addr

Security

  • Security scanPassed, 95 of 100Pattern checks on the skill's files.
  • Model reviewPassed

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

7-day trend score
5

Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/mitodl/agent-kit/vault-k8s-auth/badge)](https://verified-skill.com/skills/mitodl/agent-kit/vault-k8s-auth)

Something wrong with this skill or its page? Tell us.