SOPS

Configuration Commands

Set up .sops.yaml configuration files for automatic key selection and encryption rules.

8 commands

Pro Tips

Use creation_rules to auto-select keys based on file path

Commands

Create .sops.yaml

$ creation_rules: - path_regex: secrets/.*\.yaml$ age: age1xxx

Example .sops.yaml configuration.

List key groups

$ sops groups secrets.enc.yaml

Show key groups for encrypted file.

Exec with decrypted env

$ sops exec-env secrets.enc.yaml 'echo $DB_PASSWORD'

Export decrypted values as environment.

Multiple creation rules

$ creation_rules: - path_regex: prod/.*\.yaml$ kms: arn:aws:kms:... - path_regex: dev/.*\.yaml$ age: age1xxx

Different keys per environment path.

Key groups with threshold

$ creation_rules: - path_regex: .*\.yaml$ shamir_threshold: 2 key_groups: - age: - age1key1 - age: - age1key2

Require N of M keys to decrypt.

Encrypted regex in config

$ creation_rules: - path_regex: config/.*\.yaml$ encrypted_regex: '^(password|token|secret)$' age: age1xxx

Encrypt only secret keys via config rule.

Publish to Vault

$ sops publish --vault vault://secret/data/myapp secrets.enc.yaml

Publish decrypted secrets to HashiCorp Vault.

Show file metadata

$ sops filestatus secrets.enc.yaml

Show encryption metadata of a file.