SOPS: Secrets OPerationS Simple and Flexible Tool for Managing Secrets

Simple And Flexible Tool For Managing Secrets

Encrypt configuration Keep structure visible Access management through identities Offline and cloud based identities

SOPS encrypts configuration files while keeping the structure visible. Keys are not encrypted, while values and comments are encrypted. This allows you to understand the configuration without seeing sensible values. Also commented-out secrets aren’t suddenly visible to everyone!

SOPS supports YAML, JSON, and specific flavors of INI and DotEnv configuration files. You can also encrypt files completely through SOPS’ “binary” store.

Access to configuration is managed through identities. You can configure a set of identities that can access a file, and also require multiple identities together that a user needs access to to decrypt a file.

SOPS can use offline methods (Age, PGP/GnuPG) and online methods (cloud based KMSes, secret management software) to encrypt and decrypt a configuration’s session key. You can use SOPS in cloud infrastructure and also locally for disaster recovery.

The security of the data stored using SOPS is as strong as the weakest cryptographic mechanism. Values are encrypted using AES256 in GCM mode. How secure the key is stored depends on the identities used. For example, you can use hybrid post-quantum cryptographic encryption through Age.

SOPS supports Age and PGP/GnuPG for offline identities, and Amazon AWS KMS, Google Cloud KMS, Azure KMS, HuaweiCloud KMS, HashiCorp Vault, and OpenBAO for online identities.

SOPS is a Cloud Native Computing Foundation sandbox project