Back to Details

sops-encryption

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

SOPS Encryption

SOPS 加密

Encrypt secrets in configuration files while keeping structure visible.
在保持配置文件结构可见的同时加密其中的密钥信息。

When to Use This Skill

何时使用该技能

Use this skill when:
  • Encrypting secrets in Git
  • Implementing GitOps with secrets
  • Managing Kubernetes secrets as code
  • Encrypting configuration files
使用该技能的场景：
  • 加密Git中的密钥
  • 在GitOps中使用密钥
  • 将Kubernetes密钥作为代码管理
  • 加密配置文件

Prerequisites

前置条件

  • SOPS installed
  • KMS access (AWS, GCP, Azure) or PGP key
  • 已安装SOPS
  • 拥有KMS访问权限（AWS、GCP、Azure）或PGP密钥

Installation

安装步骤

bash
undefined
bash
undefined

macOS

macOS系统

brew install sops
brew install sops

Linux

Linux系统

wget https://github.com/getsops/sops/releases/download/v3.8.0/sops-v3.8.0.linux.amd64 chmod +x sops-v3.8.0.linux.amd64 mv sops-v3.8.0.linux.amd64 /usr/local/bin/sops
undefined
wget https://github.com/getsops/sops/releases/download/v3.8.0/sops-v3.8.0.linux.amd64 chmod +x sops-v3.8.0.linux.amd64 mv sops-v3.8.0.linux.amd64 /usr/local/bin/sops
undefined

Basic Usage

基础用法

bash
undefined
bash
undefined

Encrypt with AWS KMS

使用AWS KMS加密

sops --encrypt --kms arn:aws:kms:region:account:key/key-id secrets.yaml > secrets.enc.yaml
sops --encrypt --kms arn:aws:kms:region:account:key/key-id secrets.yaml > secrets.enc.yaml

Decrypt

解密

sops --decrypt secrets.enc.yaml
sops --decrypt secrets.enc.yaml

Edit encrypted file

编辑加密文件

sops secrets.enc.yaml
sops secrets.enc.yaml

Encrypt in place

原地加密

sops --encrypt --in-place secrets.yaml
undefined
sops --encrypt --in-place secrets.yaml
undefined

Configuration

配置示例

yaml
undefined
yaml
undefined

.sops.yaml

.sops.yaml 配置文件

creation_rules:
  • path_regex: .*.prod.yaml$ kms: arn:aws:kms:us-east-1:account:key/prod-key
  • path_regex: .*.dev.yaml$ kms: arn:aws:kms:us-east-1:account:key/dev-key
  • path_regex: .* pgp: fingerprint
undefined
creation_rules:
  • path_regex: .*.prod.yaml$ kms: arn:aws:kms:us-east-1:account:key/prod-key
  • path_regex: .*.dev.yaml$ kms: arn:aws:kms:us-east-1:account:key/dev-key
  • path_regex: .* pgp: fingerprint
undefined

Kubernetes Integration

Kubernetes 集成

yaml
undefined
yaml
undefined

encrypted secret

加密后的密钥

apiVersion: v1 kind: Secret metadata: name: myapp-secrets type: Opaque stringData: password: ENC[AES256_GCM,data:encrypted...] sops: kms: - arn: arn:aws:kms:region:account:key/key-id

```bash
apiVersion: v1 kind: Secret metadata: name: myapp-secrets type: Opaque stringData: password: ENC[AES256_GCM,data:encrypted...] sops: kms: - arn: arn:aws:kms:region:account:key/key-id

```bash

With ArgoCD

与ArgoCD配合使用

Install ksops plugin for ArgoCD to decrypt secrets

为ArgoCD安装ksops插件以解密密钥

undefined
undefined

Best Practices

最佳实践

  • Store .sops.yaml in repository
  • Use different keys per environment
  • Rotate encryption keys regularly
  • Never commit unencrypted secrets
  • Use key aliases for readability
  • 将.sops.yaml存储在代码仓库中
  • 为每个环境使用不同的密钥
  • 定期轮换加密密钥
  • 绝不提交未加密的密钥
  • 使用密钥别名提升可读性

Related Skills

相关技能

  • hashicorp-vault - Centralized secrets
  • argocd-gitops - GitOps integration
  • hashicorp-vault - 集中式密钥管理
  • argocd-gitops - GitOps集成