Skip to content

Manage Kubernetes secrets with Mozilla SOPS

In order to store secrets safely in a public or private Git repository, you can use Mozilla's SOPS CLI to encrypt Kubernetes secrets with OpenPGP, AWS KMS, GCP KMS and Azure Key Vault.


To follow this guide you'll need a Kubernetes cluster with the GitOps toolkit controllers installed on it. Please see the get started guide or the installation guide.

Install gnupg and sops:

brew install gnupg sops

Generate a GPG key

Generate a GPG key with OpenPGP without specifying a passphrase:

$ gpg --full-generate-key

Real name: stefanprodan
Email address:
You selected this USER-ID:
    "stefanprodan <>"

Retrieve the GPG key ID (second row of the sec column):

$ gpg --list-secret-keys

sec   rsa3072 2020-09-06 [SC]

Export the public and private keypair from your local GPG keyring and create a Kubernetes secret named sops-gpg in the gotk-system namespace:

gpg --export-secret-keys \
--armor 1F3D1CED2F865F5E59CA564553241F147E7C5FA4 |
kubectl create secret generic sops-gpg \
--namespace=gotk-system \

Encrypt secrets

Generate a Kubernetes secret manifest with kubectl:

kubectl -n default create secret generic basic-auth \
--from-literal=user=admin \
--from-literal=password=change-me \
--dry-run=client \
-o yaml > basic-auth.yaml

Encrypt the secret with sops using your GPG key:

sops --encrypt \
--pgp=1F3D1CED2F865F5E59CA564553241F147E7C5FA4 \
--encrypted-regex '^(data|stringData)$' \
--in-place basic-auth.yaml


Note that you should encrypt only the data section. Encrypting the Kubernetes secret metadata, kind or apiVersion is not supported by kustomize-controller.

You can now commit the encrypted secret to your Git repository.

Configure secrets decryption

Registry the Git repository on your cluster:

gotk create source git my-secrets \

Create a kustomization for reconciling the secrets on the cluster:

gotk create kustomization my-secrets \
--source=my-secrets \
--prune=true \
--interval=10m \
--decryption-provider=sops \

Note that the sops-gpg can contain more than one key, sops will try to decrypt the secrets by iterating over all the private keys until it finds one that works.


When using AWS/GCP KMS or Azure Key Vault, you'll have to bind an IAM Role with read access to the KMS keys to the default service account of the gotk-system namespace for kustomize-controller to be able to fetch keys from KMS.

GitOps workflow

A cluster admin should create the Kubernetes secret with the PGP keys on each cluster and add the GitRepository/Kustomization manifests to the fleet repository.

Git repository manifest:

kind: GitRepository
  name: my-secrets
  namespace: gotk-system
  interval: 1m

Kustomization manifest:

kind: Kustomization
  name: my-secrets
  namespace: gotk-system
  interval: 10m0s
    kind: GitRepository
    name: my-secrets
  path: ./
  prune: true
    provider: sops
      name: sops-gpg


You can generate the above manifests using gotk create <kind> --export > manifest.yaml.

Assuming a team member wants to deploy an application that needs to connect to a database using a username and password, they'll be doing the following:

  • create a Kubernetes Secret manifest locally with the db credentials e.g. db-auth.yaml
  • encrypt the secret data field with sops
  • create a Kubernetes Deployment manifest for the app e.g. app-deployment.yaml
  • add the Secret to the Deployment manifest as a volume mount or env var
  • commit the manifests db-auth.yaml and app-deployment.yaml to a Git repository that's being synced by the GitOps toolkit controllers

Once the manifests have been pushed to the Git repository, the following happens:

  • source-controller pulls the changes from Git
  • kustomize-controller loads the GPG keys from the sops-pgp secret
  • kustomize-controller decrypts the Kubernetes secrets with sops and applies them on the cluster
  • kubelet creates the pods and mounts the secret as a volume or env variable inside the app container