sops

What it does

How to write it

sops [encrypt|decrypt|edit|updatekeys|rotate] [OPTIONS] FILE

Main parts

Commands

edit FILE (or just `sops FILE`)

Open decrypted in your editor, encrypt on save.

encrypt FILE / -e

Encrypt a file.

decrypt FILE / -d

Decrypt to stdout.

updatekeys FILE

Re-encrypt for the keys now in .sops.yaml (add a person).

rotate FILE

Make a new data key.

exec-env FILE CMD

Run a command with the secrets as env vars.

exec-file FILE CMD

Run a command with a temporary decrypted file.

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Make an age key

   $age-keygen -o ~/.config/sops/age/keys.txt
   Public key: age1qz8x0examplepublickeyonly0000000000000000000000000000q9lc5

2. 2Set rules for the repo

   $cat .sops.yaml
   creation_rules:
     - path_regex: k8s/.*\.secret\.yaml$
       encrypted_regex: ^(data|stringData)$
       age: age1qz8x0examplepublickeyonly0000000000000000000000000000q9lc5

3. 3Encrypt a Kubernetes Secret

   $sops encrypt -i k8s/db.secret.yaml
   $head -12 k8s/db.secret.yaml
   apiVersion: v1
   kind: Secret
   metadata:
       name: db
   stringData:
       password: ENC[AES256_GCM,data:3kq9…,type:str]

4. 4Edit it later

   $sops k8s/db.secret.yaml

5. 5Decrypt and apply

   $sops decrypt k8s/db.secret.yaml | kubectl apply -f -

6. 6Read one value in a script

   $sops decrypt --extract '["stringData"]["password"]' k8s/db.secret.yaml

7. 7Use an Azure Key Vault key

   $sops encrypt --azure-kv https://kv-s0sta-lab.vault.azure.net/keys/sops/0123456789abcdef0123456789abcdef -i secrets.env

8. 8Run a program with secrets as variables

   $sops exec-env secrets.env 'terraform plan'

9. 9Add a new team member

   $vim .sops.yaml
   $sops updatekeys k8s/db.secret.yaml

10. 10Let Flux decrypt with the age key

    $kubectl create secret generic sops-age -n flux-system --from-file=age.agekey=$HOME/.config/sops/age/keys.txt

11. 11Stop unencrypted secrets in CI

    $grep -L "ENC\[" k8s/*.secret.yaml && echo "Unencrypted secret found" && exit 1

Nothing matches this filter.

Files

.sops.yaml

Rules: which files, which keys.

~/.config/sops/age/keys.txt

Your age private key(s).

Exit codes