Mozilla SOPS (Secrets OPerationS) is a simple and flexible tool for managing secrets. SOPS provides the scaffolding to enable the use of various encryption solutions to encrypt and decrypt select values in files whilst leaving the keys in plain-text.
SOPS supports yaml, json, env, ini and binary formats and can integrate with;
- Amazon Web Services Key Managemnt Service
- Google Cloud Platforms Key Management Service
- Azure Key Vault
- age
- and Pretty Good Privacy (PGP)
When looking at options for secret management I was searching for a solution that would have minimal overhead and enable me to keep my secrets in git along with the code. With SOPS, I can use my existing hardware backed PGP key that I use to sign my git commits as well as a secondary PGP key stored in the git repository, the private half of which only exists in GitLab for CI/CD operations.
The following example shows the beauty of SOPS, the secret is encrypted, yet the file is otherwise readable.
$ sops encrypt --encrypted-regex '^(password)$' kubernetes-secret.yaml
apiVersion: v1
kind: Secret
metadata:
name: database-password
type: Opaque
data:
password: ENC[AES256_GCM,data:hbu4wKZJbY+7YcT85yUZq7KqXA==\
,iv:mXft34AvjoRmYlXbcZ3H7qNpwkGaXDKTQ/NUjk2t4Ao=,\
tag:mqhdJX7rQJZWT664aUOd7w==,type:str]
SOPS encrypted files are self-contained and include all the information required to decrypt the file aslong as you possess the private key. SOPS appends a footer to the file that contains metadata and the master key(s) to decrypt the file. For brevity I have omitted the footer from the example above, however a complete example of a SOPS encrypted file is included in the example towards the end of this post.
Setting up SOPS with PGP
Generate PGP Keys
The following example will generate a PGP on-disk. As stated previously I use a hardware backed PGP key along with a secondary on-disk PGP key, the public half remains in the git repository with the private half only existing in GitLab for CI/CD operations.
- To generate a PGP key you can either use the snippet below or run
gpg --full-generate-keyto use the interactive wizard
export KEY_NAME="GitLab SOPS"
export KEY_COMMENT="Used for automated SOPS operations"
gpg --batch --full-generate-key <<EOF
%no-protection
Key-Type: 1
Key-Length: 4096
Subkey-Type: 1
Subkey-Length: 4096
Expire-Date: 0
Name-Comment: ${KEY_COMMENT}
Name-Real: ${KEY_NAME}
EOF
- With the PGP key created you an export the private key for use in GitLab and the public key for use in the git repository. Note that both the private and public key should be secured and backed up.
$ gpg -a --export > gitlab-sops-public.asc
$ gpg -a --export-secret-keys > gitlab-sops-private.asc
Install and Configure SOPS
- Install SOPS
sudo dnf install --assume-yes sops
- In order to configure SOPS we’ll need the PGP key fingerprints
| |
- Within your git repository create a file
.sops.yaml. The creation rule is used by SOPS to selectively encrypt all files with the specified keys. The path can be altered to use different PGP keys for different paths if desired.
creation_rules:
- path_regex: .*
encrypted_regex: '^(password)$'
key_groups:
- pgp:
- D926965E63B13548A8F05AC137F86304FE9CA39J
- BCE1F3023A9ABFCC2561AB34CA7CB93D9744872D
- With the
.sops.yamlconfigured, we can now encrypt select keys as follows matching regular expression in the.sops.yamlfile
Note that the footer includes the respective key fingerprints and master key to decrypt the file.
| |
- The file can be decrypted as follows
$ sops decrypt kubernetes-secret.yaml
apiVersion: v1
kind: Secret
metadata:
name: database-password
type: Opaque
data:
password: secret-database-password
The process above works equally well when using SOPS interactively on the command line or programmatically in a CI/CD pipeline. Overall I have been very happy with SOPS.