Overview

SOPS Operator decrypts encrypted Kubernetes secrets inside the cluster. It uses standard Kubernetes labels and namespace selectors to connect keys with the secrets that may use them.

• SopsProvider selects private key resources and the secrets allowed to use them.
• SopsSecret holds encrypted values and creates Kubernetes Secrets in its namespace.
• GlobalSopsSecret is cluster scoped and can create Secrets in multiple namespaces.

Start with installation, then follow the usage guide to configure age, OpenPGP, or Vault/OpenBao keys and encrypt your first secret.

The SOPS Checker can also verify encrypted files locally or in commit hooks before they reach the cluster.

Attribution#

The SOPS implementation builds on the Flux kustomize-controller decryptor. The original license headers are preserved. The project was inspired by sops-secrets-operator.