SOPS
Encrypt secrets inside your Git repo files, decrypt them at deploy time: the GitOps standard.
About
SOPS (Secrets OPerationS) is an open-source encrypted-file editor originally created at Mozilla and now maintained by the getsops organization as a CNCF Sandbox project. It solves one problem well: keep secrets as files in the repository, encrypted, so secret changes get Git review, history, and rollback for free. Unlike full-file encryption, SOPS encrypts only the values in YAML, JSON, ENV, INI, or binary files while leaving keys visible, so diffs stay readable and auditable.
It uses envelope encryption: file data is encrypted with a data key, which is in turn encrypted by master keys from AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, or PGP. A .sops.yaml file defines creation rules that pick the right keys per file path, and key groups support threshold decryption where multiple parties must agree. At deploy time, tools like Flux and Argo CD decrypt with the kustomize or helm controller, and the CLI offers exec-env and exec-file to run commands without secrets touching disk. A 2026 snapshot showed roughly 21,300 GitHub stars, reflecting wide adoption across DevOps and platform teams. The trade-off is that secrets are static: rotation means editing and re-encrypting, and access control is whoever holds the KMS key.
What it can do
- Encrypts file values while keeping keys readable for diffs
- YAML, JSON, ENV, INI, and binary formats
- AWS, GCP, Azure, HuaweiCloud KMS, age, and PGP backends
- Envelope encryption with per-file data keys
- .sops.yaml creation rules for automatic key selection
- Shamir-style key groups for threshold decryption
- exec-env and exec-file to avoid secrets on disk
- Go library and Terraform provider for programmatic use
- Native fit with Flux and Argo CD GitOps flows
Setup
Install the sops binary, generate an age key or point at a cloud KMS, write a .sops.yaml with creation rules, then run sops --encrypt --in-place secrets.yaml. Wire decryption into your GitOps controller (Flux kustomize-controller or Argo CD) or CI pipeline.
Prerequisites
A key management backend: age keypair, cloud KMS access, or PGP keys; a Git workflow to commit the encrypted files.
Use cases
Works with
Trust score — 9/10
Scored 9/10 (metrics tier, metrics-v1). Evidence: the getsops repository (~21.3k stars) and multiple 2026 practitioner guides confirm the Mozilla origin, CNCF Sandbox status, value-only encryption, the KMS/age/PGP backends, .sops.yaml creation rules, key groups, exec-env/exec-file, and the Flux/Argo CD GitOps integration. Strengths: the de-facto standard for Git-committed secrets, zero infrastructure to run, excellent fit with GitOps. Docked for: (1) secrets are static, so rotation is manual re-encryption; (2) no built-in access audit beyond Git history; (3) key management (age keys, KMS IAM) is the operator's problem. License: Apache-2.0 (per the GitHub repository).
★ 21,312 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 9.0/10
- Maintenance · recency, releases, issue load
- 8.0/10
- Openness · license + docs
- 10.0/10
- Manual review · sanity read + red-flag check
- 9.0/10
- · ~21.3k GitHub stars (getsops/sops); created at Mozilla, now CNCF Sandbox
- · Value-only encryption of YAML/JSON/ENV/INI/binary keeps diffs readable; envelope encryption via AWS/GCP/Azure/HuaweiCloud KMS, age, PGP
- · .sops.yaml creation rules, Shamir key groups, exec-env/exec-file; native fit with Flux and Argo CD; secrets are static (manual rotation)
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.