envoke

envoke (env + invoke) loads secrets from Bitwarden into your shell and manages named kubeconfigs — all from a single .env file.

Add shell integration once (see Installation):

eval "$(envoke shell-init)"   # add to ~/.bashrc or ~/.zshrc

Then in any directory with a .env file:

# .env
DB_PASSWORD=bw://database/prod-db
KCTX_PROD=bw://kubernetes/prod-cluster

# Load secrets + kubeconfigs
envoke resolve .env

# Switch kubeconfig
envoke switch prod

# Unload everything
envoke unload

Secrets are cached in /run/user/<uid> (or /dev/shm as fallback) and cleared automatically on shell exit, screen lock, or system sleep.

Documentation

• Installation & setup
• Configuration
• Usage
• Reference
• Known limitations
• direnv integration
• Nix integration

License

MIT © OpalBolt