Skip to content

SOPS

SOPS encrypts secret values so the file can live in Git with keys still readable for review. This course covers install, encrypt/decrypt, age and cloud KMS backends, .sops.yaml creation rules, rotation, and how Flux or Argo decrypt at apply. Ciphertext in Git is not a secrets program if the private key sits next to the repo, and SOPS does not rotate a leaked credential for you.

Intermediate3 sections · 12 lessons · ~4h total · 13-question self-test

01

SOPS fundamentals

4 lessons

01The secrets-in-Git problem & SOPSWhy plaintext in Git is dangerous.12 min 02Install, encrypt & decryptsops -e / -d in practice.10 min 03Partial encryption & structureValues encrypted, keys readable.12 min 04Editing & the workflowsops <file> and diffs.10 min

02

Keys, config & rotation

4 lessons

01Key backends: age & KMSage, AWS/GCP/Azure KMS, PGP.14 min 02.sops.yaml creation rulesAutomate which key encrypts what.12 min 03Rotation & multi-recipientMany keys; rotate without downtime.12 min 04Formats & integrationsYAML, JSON, env, binary; tooling.10 min

03

GitOps, CI/CD & alternatives

4 lessons

01SOPS in GitOpsFlux & Argo decrypt at apply.14 min 02SOPS in CI/CDDecrypt safely in pipelines.12 min 03The Vault provider & dynamic secretsBeyond static encrypted files.14 min 04The secrets-management landscapeSOPS, Sealed Secrets, ESO, Vault.10 min

Progress is saved in this browser only — no account required.

Final exam

Test yourself on everything

13 questions drawn from all 3 sections — every answer explained as you pick.

Start final exam