Encrypting Values with helm-secrets and SOPS

A key strength of SOPS is that it encrypts only the values. You can still see which keys exist, just not their secret contents.

SOPS encrypts using a master key from a provider like age, AWS KMS, or GCP KMS, so only authorized holders can decrypt.

The helm-secrets plugin bridges SOPS and Helm, letting Helm decrypt your encrypted values file on the fly during a command.

You wrap a values file with the plugin to encrypt it in place, turning plaintext secrets into safe ciphertext ready for Git.

At install or upgrade, helm-secrets decrypts the file just for that run, feeding plaintext to Helm in memory only.

You simply prefix normal Helm commands with secrets. The plugin handles decryption, then passes everything through to Helm.

You commit the encrypted file and keep the plaintext out of Git entirely. The repo holds nothing useful to an attacker.

To change who can read a secret, you rotate keys and re-encrypt the file. SOPS supports multiple recipients for shared access.

The whole model relies on the decryption key staying out of the repo, held by people or a KMS, never beside the ciphertext.

You learned how helm-secrets plus SOPS encrypts values for safe Git storage and decrypts them only at deploy time. 🎉