Set up hot-reloading Elasticsearch managed credentials on a BEDEV2 service (C, Go, or Python) so creds rotate from Vault with no service restart — both migrating an existing service off static credentials and standing up a brand-new (greenfield) service with hot-reload from the start. C services adopt Roblox.RobloxElasticsearchClient 2.0.0, which is generic over the client type and works with ANY Elasticsearch client — ES7 (NEST/Elasticsearch.Net) or ES8 (Elastic.Clients.Elasticsearch) — by supplying a ~15-line client builder; Go services on go-elasticsearch (v7 or v8) adopt the eshotreload library (NewStore + eshv7/eshv8 NewClient); Python services on elasticsearch-py (v7 or v8) adopt the roblox-eshotreload library (newstartedstore + eshotreload.es7/es8 newclient). Use when a service constructs its own Elasticsearch client (new ElasticsearchClient(...), ElasticsearchClientSettings, BasicAuthentication, ElasticsearchClientFactory in C; elasticsearch.NewClient with Username/Password/APIKey in Go; Elasticsearch(basicauth=..., apikey=...) or connectionclass with static auth in Python), reads ES creds from env vars / appsettings / config (ElasticSearchUsername, ElasticSearchPassword, ElasticsearchClientSettings, ELASTICCLIENTUSER, ESUSERNAME/ESPASSWORD, ESAPIKEY), needs to adopt managed credentials / managedsecrets.json, set meta.EnableManagedCredentials, stop restarting on credential rotation, or is asked to move to hot-reloading / rotating Elasticsearch credentials. Also use when a new or greenfield service needs to add an Elasticsearch client with rotating/hot-reload credentials, or a service already has an ES client but no managed-credentials wiring yet. Also covers eshotreload, http.RoundTripper-based credential injection (Go), the elastictransport Node / elasticsearch.connection subclass injection (Python), and the ccgen managedsecrets.json schema. As of library 2.0.0 there is NO client-version gate in C: NEST (Nest, IElasticClient) and Elasticsearch.Net (IElasticLowLevelClient) services adopt hot-reload directly via their own builder — no v7→v8 rewrite required first (a v7→v8 client migration is a separate, optional concern for ES9 readiness, not a prerequisite for credential hot-reload). Go and Python have no such gate either — v7 and v8 wrappers ship side by side.
Install with
Claude CodeCodexCursorGitHub CopilotGemini CLI
Supported by the Atlas install prompt. Skill-specific requirements vary.
Skill stats
Skills1CategorySecurityStars0
About this skill
Set up hot-reloading Elasticsearch managed credentials on a BEDEV2 service (C, Go, or Python) so creds rotate from Vault with no service restart — both migrating an existing service off static credentials and standing up a brand-new (greenfield) service with hot-reload from the start. C services adopt Roblox.RobloxElasticsearchClient 2.0.0, which is generic over the client type and works with ANY Elasticsearch client — ES7 (NEST/Elasticsearch.Net) or ES8 (Elastic.Clients.Elasticsearch) — by supplying a ~15-line client builder; Go services on go-elasticsearch (v7 or v8) adopt the eshotreload library (NewStore + eshv7/eshv8 NewClient); Python services on elasticsearch-py (v7 or v8) adopt the roblox-eshotreload library (newstartedstore + eshotreload.es7/es8 newclient). Use when a service constructs its own Elasticsearch client (new ElasticsearchClient(...), ElasticsearchClientSettings, BasicAuthentication, ElasticsearchClientFactory in C; elasticsearch.NewClient with Username/Password/APIKey in Go; Elasticsearch(basicauth=..., apikey=...) or connectionclass with static auth in Python), reads ES creds from env vars / appsettings / config (ElasticSearchUsername, ElasticSearchPassword, ElasticsearchClientSettings, ELASTICCLIENTUSER, ESUSERNAME/ESPASSWORD, ESAPIKEY), needs to adopt managed credentials / managedsecrets.json, set meta.EnableManagedCredentials, stop restarting on credential rotation, or is asked to move to hot-reloading / rotating Elasticsearch credentials. Also use when a new or greenfield service needs to add an Elasticsearch client with rotating/hot-reload credentials, or a service already has an ES client but no managed-credentials wiring yet. Also covers eshotreload, http.RoundTripper-based credential injection (Go), the elastictransport Node / elasticsearch.connection subclass injection (Python), and the ccgen managedsecrets.json schema. As of library 2.0.0 there is NO client-version gate in C: NEST (Nest, IElasticClient) and Elasticsearch.Net (IElasticLowLevelClient) services adopt hot-reload directly via their own builder — no v7→v8 rewrite required first (a v7→v8 client migration is a separate, optional concern for ES9 readiness, not a prerequisite for credential hot-reload). Go and Python have no such gate either — v7 and v8 wrappers ship side by side.
Quick start
Copy the install prompt. Use the green button above this README.
Send it to your agent. Paste it into your coding agent’s chat and send.
Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.
Set up hot-reloading Elasticsearch managed credentials on a BEDEV2 service (C#, Go, or Python) so creds rotate from Vault with no service restart — both migrating an existing service off static credentials and standing up a brand-new (greenfield) service with hot-reload from the start. C# services adopt Roblox.RobloxElasticsearchClient 2.0.0, which is generic over the client type and works with ANY Elasticsearch client — ES7 (NEST/Elasticsearch.Net) or ES8 (Elastic.Clients.Elasticsearch) — by supplying a ~15-line client builder; Go services on go-elasticsearch (v7 or v8) adopt the eshotreload library (NewStore + eshv7/eshv8 NewClient); Python services on elasticsearch-py (v7 or v8) adopt the roblox-eshotreload library (new_started_store + eshotreload.es7/es8 new_client). Use when a service constructs its own Elasticsearch client (new ElasticsearchClient(...), ElasticsearchClientSettings, BasicAuthentication, ElasticsearchClientFactory in C#; elasticsearch.NewClient with Username/Password/APIKey in Go; Elasticsearch(basic_auth=..., api_key=...) or connection_class with static auth in Python), reads ES creds from env vars / appsettings / config (ElasticSearchUsername, ElasticSearchPassword, ElasticsearchClientSettings__*, ELASTIC_CLIENT_USER_*, ES_USERNAME/ES_PASSWORD, ES_API_KEY), needs to adopt managed credentials / managed_secrets.json, set meta.EnableManagedCredentials, stop restarting on credential rotation, or is asked to move to hot-reloading / rotating Elasticsearch credentials. Also use when a new or greenfield service needs to add an Elasticsearch client with rotating/hot-reload credentials, or a service already has an ES client but no managed-credentials wiring yet. Also covers eshotreload, http.RoundTripper-based credential injection (Go), the elastic_transport Node / elasticsearch.connection subclass injection (Python), and the ccgen managed_secrets.json schema. As of library 2.0.0 there is NO client-version gate in C#: NEST (Nest, IElasticClient) and Elasticsearch.Net (IElasticLowLevelClient) services adopt hot-reload directly via their own builder — no v7→v8 rewrite required first (a v7→v8 client migration is a separate, optional concern for ES9 readiness, not a prerequisite for credential hot-reload). Go and Python have no such gate either — v7 and v8 wrappers ship side by side.
About this listing
Category
Security
Reported license
Not specified
Listing language (estimated)
English
Review status
Not individually reviewed
Agent compatibility
Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.
Claude Code
Codex
Cursor
GitHub Copilot
Gemini CLI