SOPS encrypt

sops -e -i secrets.yaml

Encrypt the secrets in configuration files with SOPS, protecting sensitive IaC values in the repository.

Run it when you want to version IaC secrets without exposing them: SOPS encrypts file values (YAML, JSON, ENV, INI) with provider keys (KMS, GCP KMS, Azure Key Vault, age, PGP), and the result is versioned securely — secrets encrypted in the repo, decrypted at deploy (sops -d). It's the reference IaC secret management (from Mozilla): the config file with encrypted secrets in the repository. In DevSecOps, SOPS is the piece for IaC secret management: encrypted secrets.yaml and keys managed by the provider (with access controlled by roles).

Don't use it as runtime secret management: SOPS encrypts at rest (files) — runtime secrets (deploy environment variables, cluster secret management) are covered by environment tools (Vault, K8s secrets, cloud secret managers). And watch out: the SOPS key (the provider's) is the single point — its management (role-based access) is the security of the secrets; a compromised key decrypts all files. Encrypted files are versioned with care (git history with previous plaintext secrets is purged). For application secrets (not IaC), use secret managers; SOPS is the IaC layer.