Skip to content
Search

Sops

lastmod 2026-02-19created 2026-02-193 edits

sops (Secrets OPerationS) is an encrypted file editor developed by Mozilla that selectively encrypts only the values in files such as YAML, JSON, ENV, and INI. Keys stay in plaintext, so Git diff works, and it supports various key backends such as age, AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault, and PGP. The de facto standard tool for version-controlling secrets in GitOps environments.

Key features

  • Partial encryption — leaves the file's keys as is and encrypts only the values. git diff shows which fields changed
  • Multiple key backends — supports age, PGP, AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault Transit
  • Multiple recipients — can encrypt with several keys at once (team environments)
  • Supported formats — YAML, JSON, ENV, INI, binary
  • Written in Go and distributed as a single binary

Installation 

# Linux
curl -LO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64
sudo mv sops-v3.9.4.linux.amd64 /usr/local/bin/sops && sudo chmod +x /usr/local/bin/sops

# macOS
brew install sops

# Docker
docker run --rm -v $(pwd):/work ghcr.io/getsops/sops:v3.9.4 --help

Basic usage 

# age 키와 함께 암호화
sops --age $(cat ~/.sops/age-key.pub) -e secrets.yaml > secrets.enc.yaml

# 복호화
export SOPS_AGE_KEY_FILE=~/.sops/age-key.txt
sops -d secrets.enc.yaml

# 인플레이스 편집 (복호화 → 편집기 → 재암호화)
sops secrets.enc.yaml

.sops.yaml configuration file

Placing .sops.yaml in the project root lets you apply encryption rules automatically per path: 

creation_rules:
  - path_regex: environments/prod/.*\.yaml$
    age: >-
      age1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx,
      age1yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
  - path_regex: environments/dev/.*\.yaml$
    age: age1zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz

Encrypted file example 

db:
    host: mydb.example.com          # key는 평문
    password: ENC[AES256_GCM,data:xxxxx,iv:yyyyy,tag:zzzzz,type:str]  # value만 암호화
    port: ENC[AES256_GCM,data:aaaa,iv:bbbb,tag:cccc,type:int]
sops:
    age:
        - recipient: age1xxxxxxxxxx
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            ...
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-02-19T10:00:00Z"
    version: 3.9.4

Kubernetes / Docker integration 

# Docker 컨테이너에서 사용
docker run --rm \
  -v $(pwd)/secrets.enc.yaml:/app/secrets.enc.yaml:ro \
  -v ~/.sops/age-key.txt:/run/age-key.txt:ro \
  -e SOPS_AGE_KEY_FILE=/run/age-key.txt \
  myapp

# Kubernetes Secret으로 변환
sops -d secrets.enc.yaml | kubectl apply -f -

# Flux (GitOps) 연동 — Flux가 자동으로 sops 복호화
kubectl create secret generic sops-age \
  --namespace=flux-system \
  --from-file=age.agekey=age-key.txt

See also

  • age - A modern encryption tool used with sops
  • GPG - Usable as a legacy key backend
  • HashiCorp Vault - Enterprise-grade secret management
  • Ansible Vault - Ansible-specific secret encryption
  • Sealed Secrets - Kubernetes-specific secret encryption (Bitnami)
  • keyring
  • SideKick - A CLI tool that lets you self-host any app on a VPS with two commands

Favorite site

author Zer0 sitemap