How to use SOPS with age for encrypting secrets?

Question

Accepted Answer

**SOPS (Secrets OPerationS)** — encrypting files with secrets. **Age** — modern alternative to GPG.

**Installation:**
```bash
brew install sops age
```

**Key generation:**
```bash
age-keygen -o key.txt
# Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
```

**Encryption:**
```bash
sops --encrypt --age age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p \
  secrets.yaml > secrets.enc.yaml
```

**secrets.yaml (plaintext):**
```yaml
db_password: supersecret
api_key: sk-xxx
```

**secrets.enc.yaml (encrypted):**
```yaml
db_password: ENC[AES256_GCM,data:xxx]
api_key: ENC[AES256_GCM,data:xxx]
sops:
  age:
    - recipient: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
        ... -----END AGE ENCRYPTED FILE-----
  lastmodified: "2024-01-15"
  version: 3.8.1
```

**Decryption:**
```bash
SOPS_AGE_KEY_FILE=key.txt sops --decrypt secrets.enc.yaml
sops --decrypt --in-place secrets.enc.yaml  # in place
```

**Kubernetes integration (helm-secrets):**
```bash
helm secrets upgrade my-release ./mychart \
  -f values.yaml \
  -f "secrets://secrets.enc.yaml" \
  --set sops.age.key-file=key.txt
```

**GitHub Actions:**
```yaml
- name: Decrypt secrets
  run: sops --decrypt --in-place secrets.enc.yaml
  env:
    SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
```

**SOPS + AWS KMS:** `sops --encrypt --kms arn:aws:kms:... secrets.yaml`.

DevOps: How to use SOPS with age for encrypting secrets?