SOPS, give your secrets a good scrubbing in the clear!
summary
SOPS is a tool that encrypts secrets into standalone files so Git can store credentials without a central server, using a symmetric data key wrapped for each recipient’s public key plus HMAC and version metadata for integrity. It provides CLI commands for encrypt/decrypt/edit, supports partial-field encryption via regex, key rotation, and KMS backends (AWS/GCP/Azure), and uses a sops.yaml rules file to map recipients to file patterns; integrations for Terraform, Helm, Argo CD and Flux are shown, with a demo where Alice and Bob have access while nonrecipients are denied.
AI-written summary · about
chapters (11)
- 0:00SOPS introduction
- 1:24SOPS overview
- 2:06Encrypted files with SOPS
- 3:32Encrypt file with SOPS
- 4:56Decrypt secrets
- 6:00Secure command execution
- 7:02Recipient management
- 7:43Demo with Alice and Bob
- 10:34Plaintext secrets versioning
- 11:18Git filters for SOPS
- 12:00Integrations and conclusion
related talks
20mSOPS, Give Your Secrets a Good Scrubbing!
14mSOPS, Give Your Secrets a Good Scrubbing in the Clear!
16mSOPS, Give Your Secrets a Soap — Cleanse Them Now!
10mLightning Talk: How to Keep a Secret in GitOps, Without Keeping...
29m100,000 Different Ways to Manage Secrets in GitOps
43mSecuring Secrets in the GitOps Era
26mThe Power of SecretOps Automating Secret Workflows
09mSecuring GitOps