AI Knowledge Hubsops — structured file secrets management
💬 "sops command"
sops handles structured file secret management by encrypting only certain values in JSON, YAML, and TOML. Secrets remain hidden even when committed to Git.
It recognizes JSON, YAML, TOML, ENV, and INI structures. Only values are encrypted, while keys and structure are kept in plain text.
- Concept: Recognizes JSON, YAML, TOML, ENV, and INI structures.
- Key Features: Encrypts only values, keeping keys and structure in plain text.
- Advantages: Supports age, PGP, KMS, GCP, AWS, and Azure key backends.
- Usage: Diff remains readable even after Git commits.
Installation and Download
sops is installed via a package manager or an official script.
| Environment | Command |
|---|---|
| Go install | go install go.mozilla.org/sops/v3/cmd/sops@latest |
| macOS (brew) | brew install sops |
| Official Binary | github.com/getsops/sops/releases |
| Verification | sops --version |
Installation can be verified using sops --version.
Frequently Used Options
| Options | Description |
|---|---|
| -e, --encrypt | Encrypt (file to standard output) |
| -d, --decrypt | Decrypt |
| -i, --in-place | Modifies the original file in place |
| --set <path> <value> | Sets and encrypts a specific path value |
| --extract <path> | Extracts only the value at a specific path |
3 Essential Command Combinations
sops -e secrets.yaml > secrets.enc.yaml— Encrypt entire filesops -d secrets.enc.yaml— Decryptsops --set '["db"]["password"] "newpass"' secrets.enc.yaml— Update value
💬 "Show me an example of using sops on a real server"
Here are common scenarios encountered on production servers, listed in order.
Step 1: Key Setup
Register the age public key in .sops.yaml.
echo 'creation_rules:\n - path_regex: secrets\\.ya?ml$\n age: age1...' > .sops.yaml
Step 2: Encryption
Encrypt the secrets file.
sops -e secrets.yaml > secrets.enc.yaml
Step 3: Git Commit
Commit the encrypted file.
git add .sops.yaml secrets.enc.yaml && git commit -m 'Add secrets'
Actual Execution Screen
This is the result of encrypting a YAML value with sops.
!sops command execution result
Production server
In Practice, It's Used Like This
1. docker-compose Secret Management
Situation — Encrypt only the password in docker-compose.yml.
sops -e docker-compose.yml > docker-compose.enc.yml
Result — The password value changes to ENC[AES256_GCM,...].
Point — Keys and structure remain in plain text, making diff readable.
2. Decryption After Git Commit
Situation — Commit the encrypted file to git and decrypt during deployment.
git add .sops.yaml secrets.enc.yaml && git commit -m 'secrets'
sops -d secrets.enc.yaml
Result — Only ENC[...] remains in Git, and it's decrypted to actual values during deployment.
Point — Register the age public key in .sops.yaml.
Actual Execution Screen
This is the result of decrypting with sops -d.
!sops command execution result 2
Production server
Points to Note
- The creation_rules in .sops.yaml must match the actual file paths. Mismatches will cause encryption to fail.
- Losing the private key makes decryption impossible. Always back up your keys, whether age or PGP.
- sops may not recognize the structure of ENV format files.
Source (HTML): https://games.aidebatehub.com/programs/linux/security/sops.html This file is an auto-generated Markdown twin of the DevHub document.
Visitor Comments