Mozilla SOPS: Secrets OPerationS
I wrote a blog post about managing secrets in GitLab / Git some time ago, where I touched sops . Today, I am going to write more about this tool. sops is useful when you want to encrypt your data and keep it somewhere securely. Why is it so secure? Because it uses envelope encryption . This way you can keep your encrypted data and encrypted data key (which is needed to decrypt your data ) in the same file. So, when everything is encrypted you can store it anywhere, for example in your git repository. How it works? sops generates a data key and this data key is used to encrypt and decrypt your data . So, how then is your data key encrypted? 🤔 By your KMS or PGP master key (or both of them, or even more... sops supports AWS KMS , GCP KMS, Azure Key Vault and PGP). As you can see, sops only touches your data key and your data . With your master/wrapping key you encrypt and decrypt your data key . By default, you can encrypt and decrypt your data key by each master key . Bu