Encrypting Values with helm-secrets and SOPS

What if you could safely keep secret values in Git? Encryption makes that possible: the file is unreadable without the right key. 🔐

SOPS is a tool that encrypts the values inside a YAML file while leaving the keys readable, so diffs still make sense.

A key strength of SOPS is that it encrypts only the values. You can still see which keys exist, just not their secret contents.

SOPS encrypts using a master key from a provider like age, AWS KMS, or GCP KMS, so only authorized holders can decrypt.

The helm-secrets plugin bridges SOPS and Helm, letting Helm decrypt your encrypted values file on the fly during a command.

You wrap a values file with the plugin to encrypt it in place, turning plaintext secrets into safe ciphertext ready for Git.

At install or upgrade, helm-secrets decrypts the file just for that run, feeding plaintext to Helm in memory only.

You simply prefix normal Helm commands with secrets. The plugin handles decryption, then passes everything through to Helm.

You commit the encrypted file and keep the plaintext out of Git entirely. The repo holds nothing useful to an attacker.

To change who can read a secret, you rotate keys and re-encrypt the file. SOPS supports multiple recipients for shared access.

The whole model relies on the decryption key staying out of the repo, held by people or a KMS, never beside the ciphertext.

What does SOPS encrypt in a YAML file?

You learned how helm-secrets plus SOPS encrypts values for safe Git storage and decrypts them only at deploy time. 🎉