diff --git a/pkg/config/lazyTools.go b/pkg/config/lazyTools.go
index 9916a0d..3dab46b 100644
--- a/pkg/config/lazyTools.go
+++ b/pkg/config/lazyTools.go
@@ -11,6 +11,7 @@ import (
 	"github.com/zostay/genifest/pkg/client/k8s"
 
 	k8scfg "github.com/zostay/genifest/pkg/config/kubecfg"
+	k8smgr "github.com/zostay/genifest/pkg/manager/k8scfg"
 )
 
 type LazyTools struct {
@@ -53,9 +54,9 @@ func (t *LazyTools) IAM() (*iam.Client, error) {
 	return t.iam, nil
 }
 
-func (t *LazyTools) ResMgr(ctx context.Context) (*k8scfg.Client, error) {
+func (t *LazyTools) ResMgr(ctx context.Context, skipSecrets bool) (*k8scfg.Client, error) {
 	rmgr := k8scfg.New(t.cf.CloudHome)
-	rmgr.SetFuncMap(t.makeFuncMap(ctx, rmgr))
+	rmgr.SetFuncMap(t.makeFuncMap(ctx, rmgr, skipSecrets))
 	return rmgr, nil
 }
 
@@ -64,6 +65,7 @@ func (t *LazyTools) ResMgr(ctx context.Context) (*k8scfg.Client, error) {
 func (t *LazyTools) makeFuncMap(
 	ctx context.Context,
 	rmgr *k8scfg.Client,
+	skipSecrets bool,
 ) template.FuncMap {
 	aws := tmpltools.AWS{
 		Region: t.c.AWS.Region,
@@ -83,7 +85,7 @@ func (t *LazyTools) makeFuncMap(
 		return rmgr.TemplateConfigFile(name, []byte(data))
 	}
 
-	return template.FuncMap{
+	fm := template.FuncMap{
 		"tomlize":                    tmpltools.Tomlize,
 		"secretDict":                 ghost.SecretDict,
 		"ddbLookup":                  aws.DDBLookup,
@@ -96,4 +98,15 @@ func (t *LazyTools) makeFuncMap(
 		"zostaySecret":               ghost.Secret,
 		"kubeseal":                   tmpltools.KubeSeal,
 	}
+
+	if skipSecrets {
+		secretsDie := func(_ ...interface{}) (string, error) {
+			return "", k8smgr.ErrSecret
+		}
+		fm["kubeseal"] = secretsDie
+		fm["sshKey"] = secretsDie
+		fm["zostaySecret"] = secretsDie
+	}
+
+	return fm
 }
diff --git a/pkg/manager/k8s/generate.go b/pkg/manager/k8s/generate.go
index 191e8b5..4584ae2 100644
--- a/pkg/manager/k8s/generate.go
+++ b/pkg/manager/k8s/generate.go
@@ -93,7 +93,7 @@ func GenerateK8sResources(
 				continue
 			}
 
-			err = k8scfg.SaveResourceFile(ctx, tools, appDir, sr)
+			err = k8scfg.SaveResourceFile(ctx, tools, appDir, sr, skipSecrets)
 			if err != nil {
 				errs = append(errs, fmt.Errorf("k8scfg.SaveResourceFile(): %w", err))
 				errsThisTime++
diff --git a/pkg/manager/k8scfg/interface.go b/pkg/manager/k8scfg/interface.go
index ed83217..d5b085a 100644
--- a/pkg/manager/k8scfg/interface.go
+++ b/pkg/manager/k8scfg/interface.go
@@ -11,7 +11,7 @@ import (
 type Tools interface {
 	Kube() (*k8s.Client, error)
 
-	ResMgr(context.Context) (*k8scfg.Client, error)
+	ResMgr(context.Context, bool) (*k8scfg.Client, error)
 
 	IAM() (*iam.Client, error)
 }
diff --git a/pkg/manager/k8scfg/process.go b/pkg/manager/k8scfg/process.go
index 6f8e66c..47d15c0 100644
--- a/pkg/manager/k8scfg/process.go
+++ b/pkg/manager/k8scfg/process.go
@@ -28,20 +28,11 @@ func ProcessResourceFile(
 	config string,
 	skipSecrets bool,
 ) ([]k8scfg.Resource, error) {
-	c, err := tools.ResMgr(ctx)
+	c, err := tools.ResMgr(ctx, skipSecrets)
 	if err != nil {
 		return nil, fmt.Errorf("tools.ResMgr(): %w", err)
 	}
 
-	if skipSecrets {
-		secretsDie := func(_ ...interface{}) (string, error) {
-			return "", ErrSecret
-		}
-		c.SetFunc("kubeseal", secretsDie)
-		c.SetFunc("sshKey", secretsDie)
-		c.SetFunc("zostaySecret", secretsDie)
-	}
-
 	cfs, err := c.ReadResourceFile(config)
 	if err != nil {
 		return nil, fmt.Errorf("c.ReadResourceFile(): %w", err)
diff --git a/pkg/manager/k8scfg/save.go b/pkg/manager/k8scfg/save.go
index 7ec1a3d..2a46a75 100644
--- a/pkg/manager/k8scfg/save.go
+++ b/pkg/manager/k8scfg/save.go
@@ -15,8 +15,9 @@ func SaveResourceFile(
 	tools Tools,
 	saveDir string,
 	sr *k8s.SerializedResource,
+	skipSecrets bool,
 ) error {
-	c, err := tools.ResMgr(ctx)
+	c, err := tools.ResMgr(ctx, skipSecrets)
 	if err != nil {
 		return fmt.Errorf("tools.ResMgr(): %w", err)
 	}