A Peak Scale Kubernetes addon
Manage SOPS keys with Kubernetes resources.
Give teams control of their secrets with SOPS Operator.
Open source · Kubernetes native · Works with or without Capsule
Use providers, labels, and namespace selectors to control which keys can decrypt each team's secrets.
Configure providers →Apply SOPS-encrypted resources directly. Decryption happens inside your cluster with age, OpenPGP, or Vault/OpenBao.
How it works →Use the standalone SOPS Checker binary or container to catch plaintext files in local hooks and CI.
Set up SOPS Checker →SOPS Operator brings the Flux approach to SOPS to a standalone Kubernetes operator. Keep encrypted secrets in Git, distribute keys through Kubernetes resources, and decrypt secrets inside the cluster.
A SopsProvider connects private keys to the SopsSecrets allowed to use them.
Cluster administrators control those connections, while teams can manage their own
keys and encrypted secrets. GlobalSopsSecret supports secrets across namespaces.
Use it with Capsule or on its own, independently of your GitOps engine.
Explore the interactive Killercoda demonstration. For enterprise support, contact Peak Scale.