Sops Encryption
- 142 installs
- 44 repo stars
- Updated May 22, 2026
- bagelhole/devops-security-agent-skills
Encrypt, decrypt, and rotate secrets in repos and CI using Mozilla SOPS with KMS, PGP, or age keys before release and during credential updates.
About
Teaches agents to manage secrets with Mozilla SOPS across repositories and CI/CD, including encrypting YAML and env files, selecting KMS or age keys, validating decryption in pipelines, and rotating credentials without exposing plaintext in version control.
- SOPS file creation and editing workflows
- KMS, PGP, and age key patterns
- CI decrypt and re-encrypt procedures
- Prevents plaintext secrets in git
- Rotation and access-boundary guidance
Sops Encryption by the numbers
- 142 all-time installs (skills.sh)
- Ranked #905 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Jul 28, 2026 (Skillselion catalog sync)
npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill sops-encryptionAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 142 |
|---|---|
| repo stars | ★ 44 |
| Last updated | May 22, 2026 |
| Repository | bagelhole/devops-security-agent-skills ↗ |
What it does
Encrypt, decrypt, and rotate secrets in repos and CI using Mozilla SOPS with KMS, PGP, or age keys before release and during credential updates.
Files
SOPS Encryption
Encrypt secrets in configuration files while keeping structure visible.
When to Use This Skill
Use this skill when:
- Encrypting secrets in Git
- Implementing GitOps with secrets
- Managing Kubernetes secrets as code
- Encrypting configuration files
Prerequisites
- SOPS installed
- KMS access (AWS, GCP, Azure) or PGP key
Installation
# macOS
brew install sops
# Linux
wget https://github.com/getsops/sops/releases/download/v3.8.0/sops-v3.8.0.linux.amd64
chmod +x sops-v3.8.0.linux.amd64
mv sops-v3.8.0.linux.amd64 /usr/local/bin/sopsBasic Usage
# Encrypt with AWS KMS
sops --encrypt --kms arn:aws:kms:region:account:key/key-id secrets.yaml > secrets.enc.yaml
# Decrypt
sops --decrypt secrets.enc.yaml
# Edit encrypted file
sops secrets.enc.yaml
# Encrypt in place
sops --encrypt --in-place secrets.yamlConfiguration
# .sops.yaml
creation_rules:
- path_regex: .*\.prod\.yaml$
kms: arn:aws:kms:us-east-1:account:key/prod-key
- path_regex: .*\.dev\.yaml$
kms: arn:aws:kms:us-east-1:account:key/dev-key
- path_regex: .*
pgp: fingerprintKubernetes Integration
# encrypted secret
apiVersion: v1
kind: Secret
metadata:
name: myapp-secrets
type: Opaque
stringData:
password: ENC[AES256_GCM,data:encrypted...]
sops:
kms:
- arn: arn:aws:kms:region:account:key/key-id# With ArgoCD
# Install ksops plugin for ArgoCD to decrypt secretsBest Practices
- Store .sops.yaml in repository
- Use different keys per environment
- Rotate encryption keys regularly
- Never commit unencrypted secrets
- Use key aliases for readability
Related Skills
- hashicorp-vault - Centralized secrets
- argocd-gitops - GitOps integration
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85