SOPS: Secrets in Plain Sight
Shriira Press
Encrypt the secrets, keep the structure — how SOPS lets you store sensitive configuration safely in plain sight, right inside Git.
Welcome to SOPS: Secrets in Plain Sight.
SOPS, short for Secrets OPerationS, is a small command-line tool with an outsized role in the cloud-native world. It solves a problem that haunts almost every team: how do you store passwords, API tokens, and certificates alongside your code without leaking them, and without building a heavyweight secrets platform to do it? SOPS answers by encrypting the values in a file while leaving the keys readable, so an encrypted YAML or JSON file still diffs cleanly in version control, reviews like ordinary configuration, and can sit comfortably in a public-ish repository. It encrypts those values with a backend of your choice — AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault, the modern age tool, or classic PGP — and it never ties you to just one. This book starts with the secrets-in-Git problem, then works through the encrypted file format and the data-key protocol that makes it tick, the key backends, the .sops.yaml configuration that automates everything, the editing and operational commands, advanced features like key groups and Shamir thresholds, and finally how SOPS plugs into Flux, Helm, and Terraform for real GitOps workflows.
This title is part of the ShriIra library and is free to read in full, right here — our small contribution to making world-class knowledge easy to reach.
A note on reading it: open the Contents menu at the top of the reader to jump between chapters, use the Aa menu to set a comfortable text size, theme (light, sepia, or night), and single- or two-page layout. Your place is saved automatically, so you can always pick up where you left off.
We hope it serves you well.
— Shriira Press