How do I install the Sops Encryption skill?

Run npx skillmds add majiayu000/sops-encryption in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Sops Encryption safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Sops Encryption?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Sops Encryption free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Sops Encryption?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Sops Encryption by majiayu000 — Agent Skill

Name: Sops Encryption
Rating: 4.5 (4 reviews)
Author: majiayu000

Sops Encryption

Encrypt files and configs with Mozilla SOPS. Integrate with AWS KMS, GCP KMS, or PGP for key management. Use when encrypting configuration files, Kubernetes secrets, or implementing GitOps with encrypted secrets.

majiayu000 c4c5183 2 files · 3.0 KB Updated Sep 9, 2026 567 repo stars

File contents

SOPS Encryption

Encrypt secrets in configuration files while keeping structure visible.

When to Use This Skill

Use this skill when:

Encrypting secrets in Git
Implementing GitOps with secrets
Managing Kubernetes secrets as code
Encrypting configuration files

Prerequisites

SOPS installed
KMS access (AWS, GCP, Azure) or PGP key

Installation

# macOS
brew install sops

# Linux
wget https://github.com/getsops/sops/releases/download/v3.8.0/sops-v3.8.0.linux.amd64
chmod +x sops-v3.8.0.linux.amd64
mv sops-v3.8.0.linux.amd64 /usr/local/bin/sops

Basic Usage

# Encrypt with AWS KMS
sops --encrypt --kms arn:aws:kms:region:account:key/key-id secrets.yaml > secrets.enc.yaml

# Decrypt
sops --decrypt secrets.enc.yaml

# Edit encrypted file
sops secrets.enc.yaml

# Encrypt in place
sops --encrypt --in-place secrets.yaml

Configuration

# .sops.yaml
creation_rules:
  - path_regex: .*\.prod\.yaml$
    kms: arn:aws:kms:us-east-1:account:key/prod-key
  - path_regex: .*\.dev\.yaml$
    kms: arn:aws:kms:us-east-1:account:key/dev-key
  - path_regex: .*
    pgp: fingerprint

Kubernetes Integration

# encrypted secret
apiVersion: v1
kind: Secret
metadata:
  name: myapp-secrets
type: Opaque
stringData:
  password: ENC[AES256_GCM,data:encrypted...]
sops:
  kms:
    - arn: arn:aws:kms:region:account:key/key-id

# With ArgoCD
# Install ksops plugin for ArgoCD to decrypt secrets

Best Practices

Store .sops.yaml in repository
Use different keys per environment
Rotate encryption keys regularly
Never commit unencrypted secrets
Use key aliases for readability

Related Skills

hashicorp-vault - Centralized secrets
argocd-gitops - GitOps integration

---name: sops-encryptiondescription: Encrypt files and configs with Mozilla SOPS. Integrate with AWS KMS, GCP KMS, or PGP for key management. Use when encrypting configuration files, Kubernetes secrets, or implementing GitOps with encrypted secrets.license: MIT--- # SOPS Encryption Encrypt secrets in configuration files while keeping structure visible. ## When to Use This Skill Use this skill when: - Encrypting secrets in Git - Implementing GitOps with secrets - Managing Kubernetes secrets as code - Encrypting configuration files ## Prerequisites - SOPS installed - KMS access (AWS, GCP, Azure) or PGP key ## Installation ```bash # macOS brew install sops # Linux wget https://github.com/getsops/sops/releases/download/v3.8.0/sops-v3.8.0.linux.amd64 chmod +x sops-v3.8.0.linux.amd64 mv sops-v3.8.0.linux.amd64 /usr/local/bin/sops ``` ## Basic Usage ```bash # Encrypt with AWS KMS sops --encrypt --kms arn:aws:kms:region:account:key/key-id secrets.yaml > secrets.enc.yaml # Decrypt sops --decrypt secrets.enc.yaml # Edit encrypted file sops secrets.enc.yaml # Encrypt in place sops --encrypt --in-place secrets.yaml ``` ## Configuration ```yaml # .sops.yaml creation_rules: - path_regex: .*\.prod\.yaml$ kms: arn:aws:kms:us-east-1:account:key/prod-key - path_regex: .*\.dev\.yaml$ kms: arn:aws:kms:us-east-1:account:key/dev-key - path_regex: .* pgp: fingerprint ``` ## Kubernetes Integration ```yaml # encrypted secret apiVersion: v1 kind: Secret metadata: name: myapp-secrets type: Opaque stringData: password: ENC[AES256_GCM,data:encrypted...] sops: kms: - arn: arn:aws:kms:region:account:key/key-id ``` ```bash # With ArgoCD # Install ksops plugin for ArgoCD to decrypt secrets ``` ## Best Practices - Store .sops.yaml in repository - Use different keys per environment - Rotate encryption keys regularly - Never commit unencrypted secrets - Use key aliases for readability ## Related Skills - [hashicorp-vault](../hashicorp-vault/) - Centralized secrets - [argocd-gitops](../../../devops/orchestration/argocd-gitops/) - GitOps integration

Frequently asked questions