name: sops-encryption description: Encrypt files and configs with Mozilla SOPS. category: security risk: critical source: https://github.com/BagelHole/DevOps-Security-Agent-Skills source_repo: BagelHole/DevOps-Security-Agent-Skills source_type: community date_added: '2026-09-20' license: MIT license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE compatibility: Requires the relevant security tooling (scanners, vault CLIs) and an authorized scope for any active assessment. Docs-only; helper scripts and templates not bundled. metadata: author: devops-skills version: '1.0'

SOPS Encryption

Encrypt secrets in configuration files while keeping structure visible.

When to Use This Skill

Use this skill when:

• Encrypting secrets in Git
• Implementing GitOps with secrets
• Managing Kubernetes secrets as code
• Encrypting configuration files

Prerequisites

• SOPS installed
• KMS access (AWS, GCP, Azure) or PGP key

Installation

# macOS
brew install sops
 
# Linux
# Choose a supported release for the actual OS/architecture.
# Verify publisher signatures/checksums through an independent trusted channel
# before execution; use an authorized install destination.

Basic Usage

# Encrypt with AWS KMS
sops --encrypt --kms arn:aws:kms:region:account:key/key-id secrets.yaml > secrets.enc.yaml
 
# Decrypt only into a private authorized destination; never print plaintext in captured logs
# Review the installed SOPS output options before decrypting
 
# Edit encrypted file
sops secrets.enc.yaml
 
# Encrypt in place
sops --encrypt --in-place secrets.yaml

Configuration

# .sops.yaml
creation_rules:
  - path_regex: .*\.prod\.yaml$
    kms: arn:aws:kms:us-east-1:account:key/prod-key
  - path_regex: .*\.dev\.yaml$
    kms: arn:aws:kms:us-east-1:account:key/dev-key
  - path_regex: .*
    pgp: fingerprint

Kubernetes Integration

# encrypted secret
apiVersion: v1
kind: Secret
metadata:
  name: myapp-secrets
type: Opaque
stringData:
  password: ENC[AES256_GCM,data:encrypted...]
sops:
  kms:
    - arn: arn:aws:kms:region:account:key/key-id

# With ArgoCD
# Install ksops plugin for ArgoCD to decrypt secrets

Best Practices

• Store .sops.yaml in repository
• Use different keys per environment
• Rotate encryption keys regularly
• Never commit unencrypted secrets
• Use key aliases for readability

Related Skills

• hashicorp-vault (hashicorp-vault) - Centralized secrets
• argocd-gitops (argocd-gitops) - GitOps integration

Limitations

• Apply guidance only within authorized scope; test destructive steps in non-production first.
• Docs-only import: upstream scripts and templates not bundled.

Example

# Read-only first: inventory before any active step.
which <tool> && <tool> --help | head -n 20

Adapted from BagelHole/DevOps-Security-Agent-Skills (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.

Execution boundaries

Review encryption output before replacing originals. Decrypting to stdout can expose secrets in agent/tool logs. Use synthetic data for validation, restrict output permissions and never commit plaintext. The abbreviated encrypted Kubernetes example is illustrative, not a valid ciphertext to deploy.