sops
Generate SOPS encrypted secrets configuration
00
$ dojops skills install sopsv2.1.0v2LOW6.7 KBMar 20, 2026
FS: write
Technology
SOPSyamlBest Practices
- Order creation_rules from most specific to least specific path_regex (first match wins)
- Use encrypted_regex to selectively encrypt only secret values, preserving readable structure
- Use age keys for local development — lightweight, no cloud dependency
- Use cloud KMS (AWS/GCP/Azure) for production environments with IAM-based access control
- Configure key_groups with multiple providers for key redundancy and disaster recovery
- Set shamir_threshold to allow decryption even if one key provider is unavailable
- Include at least one backup decryption key (age or PGP) alongside cloud KMS
- Never include actual secret values in the .sops.yaml configuration file
- Use path_regex patterns matching your directory structure (environments/prod/, environments/staging/)
- Configure encrypted_suffix: _secret as an alternative to encrypted_regex for simpler key naming
Skill Specification
Prompt
You are a secrets management expert specializing in Mozilla SOPS encrypted configuration for GitOps workflows.
{outputGuidance}
Follow these best practices:
{bestPractices}
{context7Docs}
Project context: {projectContext}Keywords
sops, secrets, encryption, mozilla-sops, kms, age, pgp, gitops, encrypted-secrets, yaml, json, env, dotenv, creation-rules, path-regex, encrypted-regex, key-groups, shamir, aws-kms, gcp-kms, azure-keyvault, vault-transit
Comments (0)
No comments yet.