{
  "id": "stack-profile:secrets-management",
  "_kind": "StackProfile",
  "_file": "domain/stack-profiles/deep-stacks-5.yaml",
  "_cluster": "domain",
  "attributes": {
    "displayName": "Secrets Management (Vault, Kubernetes, Terraform, Docker, Go)",
    "description": "A centralized secrets management platform built around HashiCorp Vault\nfor dynamic secret generation, encryption-as-a-service, and PKI\ncertificate issuance. Kubernetes workloads consume secrets via the Vault\nAgent sidecar injector, eliminating plaintext secrets in environment\nvariables or ConfigMaps. Terraform provisions Vault policies, auth\nbackends, and secret engines as code. Custom Go tooling provides CLI\nwrappers for developer self-service secret rotation. Deployed in Docker\ncontainers with HA storage backends. The tradeoff is Vault's operational\ncomplexity — unsealing, audit log management, and upgrade procedures\nrequire dedicated platform engineering attention.\n",
    "composes": [
      "tool:vault",
      "tool:kubernetes",
      "tool:terraform",
      "tool:docker",
      "language:go",
      "tool:sops",
      "language:hcl",
      "tool:helm"
    ]
  },
  "outgoingEdges": [
    {
      "from": "stack-profile:secrets-management",
      "to": "tool:vault",
      "kind": "composed_of"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "tool:kubernetes",
      "kind": "composed_of"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "tool:terraform",
      "kind": "composed_of"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "tool:docker",
      "kind": "composed_of"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "language:go",
      "kind": "composed_of"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "tool:sops",
      "kind": "composed_of"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "language:hcl",
      "kind": "composed_of"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "tool:helm",
      "kind": "composed_of"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "role:security-engineer",
      "kind": "used_by_role"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "role:platform-engineer",
      "kind": "used_by_role"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "role:devops-engineer",
      "kind": "used_by_role"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "workflow:secret-rotation",
      "kind": "follows_workflow"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "workflow:certificate-rotation",
      "kind": "follows_workflow"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "domain:cybersecurity",
      "kind": "applies_to"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "domain:platform-engineering",
      "kind": "applies_to"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "skill-area:secrets-rotation",
      "kind": "requires_skill_area"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "skill-area:identity-security",
      "kind": "requires_skill_area"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "skill-area:iac-security",
      "kind": "requires_skill_area"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "skill-area:k8s-rbac",
      "kind": "requires_skill_area"
    },
    {
      "from": "stack-profile:secrets-management",
      "to": "skill-area:policy-enforcement",
      "kind": "requires_skill_area"
    }
  ],
  "incomingEdges": []
}