360 Secure SkillHub
360 安全技能中心

sops-encryption

该 Skill 提供 SOPS 的命令行用法与配置示例，用于加密、解密和原地加密配置文件及 Kubernetes Secret，并说明通过 AWS、GCP、Azure KMS 或 PGP 管理密钥及在 GitOps 中保留配置结构。内容以操作指南为主，包含 .sops.yaml 规则和最佳实践，未提供密钥轮换或 ArgoCD 插件的完整实现。

BagelHole
热度 0.00
最近更新 2026-10-19 06:52:50
分类：安全依赖：代码执行 / 读写文件 / 第三方 API应用场景：DevOps / 自动化脚本 / 工作流 / API 集成

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add bagelhole/devops-security-agent-skills/sops-encryption
Metadata
name
sops-encryption
description
Encrypt files and configs with Mozilla SOPS. Integrate with AWS KMS, GCP KMS, or PGP for key management. Use when encrypting configuration files, Kubernetes secrets, or implementing GitOps with encrypted secrets.
license
MIT
metadata
{"author":"devops-skills","version":"1.0"}

SOPS Encryption

Encrypt secrets in configuration files while keeping structure visible.

When to Use This Skill

Use this skill when:

  • Encrypting secrets in Git
  • Implementing GitOps with secrets
  • Managing Kubernetes secrets as code
  • Encrypting configuration files

Prerequisites

  • SOPS installed
  • KMS access (AWS, GCP, Azure) or PGP key

Installation

# macOS
brew install sops

# Linux
wget https://github.com/getsops/sops/releases/download/v3.8.0/sops-v3.8.0.linux.amd64
chmod +x sops-v3.8.0.linux.amd64
mv sops-v3.8.0.linux.amd64 /usr/local/bin/sops

Basic Usage

# Encrypt with AWS KMS
sops --encrypt --kms arn:aws:kms:region:account:key/key-id secrets.yaml > secrets.enc.yaml

# Decrypt
sops --decrypt secrets.enc.yaml

# Edit encrypted file
sops secrets.enc.yaml

# Encrypt in place
sops --encrypt --in-place secrets.yaml

Configuration

# .sops.yaml
creation_rules:
  - path_regex: .*\.prod\.yaml$
    kms: arn:aws:kms:us-east-1:account:key/prod-key
  - path_regex: .*\.dev\.yaml$
    kms: arn:aws:kms:us-east-1:account:key/dev-key
  - path_regex: .*
    pgp: fingerprint

Kubernetes Integration

# encrypted secret
apiVersion: v1
kind: Secret
metadata:
  name: myapp-secrets
type: Opaque
stringData:
  password: ENC[AES256_GCM,data:encrypted...]
sops:
  kms:
    - arn: arn:aws:kms:region:account:key/key-id

# With ArgoCD
# Install ksops plugin for ArgoCD to decrypt secrets

Best Practices

  • Store .sops.yaml in repository
  • Use different keys per environment
  • Rotate encryption keys regularly
  • Never commit unencrypted secrets
  • Use key aliases for readability

Related Skills