SOPS

Decryption Commands

Decrypt SOPS-encrypted files and extract specific values for use in scripts and applications.

7 commands

Pro Tips

Use --extract to get specific keys without decrypting entire file

Common Mistakes

Never commit decrypted secrets to version control

Commands

Decrypt file

$ sops -d secrets.enc.yaml > secrets.yaml

Decrypt YAML file.

Decrypt to stdout

$ sops -d secrets.enc.yaml

Decrypt and print to stdout.

Extract specific key

$ sops -d --extract '["db"]["password"]' secrets.enc.yaml

Extract single value from encrypted file.

Decrypt in place

$ sops -d -i secrets.enc.yaml

Decrypt file in place.

Decrypt and run as env vars

$ sops exec-env secrets.enc.yaml 'my-app --start'

Decrypt and pass as environment to command.

Decrypt and run with temp file

$ sops exec-file secrets.enc.yaml 'my-app --config {}'

Decrypt to temp file and pass to command.

Decrypt for piping

$ sops -d secrets.enc.yaml | kubectl apply -f -

Decrypt and pipe to another command.