How do I install the Sops Encryption skill?

Run npx skillmds@latest add tomevault-io/sops-encryption in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Sops Encryption safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Sops Encryption?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Sops Encryption free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Sops Encryption?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Sops Encryption by tomevault-io — Agent Skill

Name: Sops Encryption
Author: tomevault-io

Sops Encryption

Encrypt files and configs with Mozilla SOPS. Integrate with AWS KMS, GCP KMS, or PGP for key management. Use when encrypting configuration files, Kubernetes secrets, or implementing GitOps with encrypted secrets. Use when this capability is needed.

tomevault-io 7d94dd6 2 files · 2.9 KB Updated Sep 17, 2026

File contents

SOPS Encryption

Encrypt secrets in configuration files while keeping structure visible.

When to Use This Skill

Use this skill when:

Encrypting secrets in Git
Implementing GitOps with secrets
Managing Kubernetes secrets as code
Encrypting configuration files

Prerequisites

SOPS installed
KMS access (AWS, GCP, Azure) or PGP key

Installation

# macOS
brew install sops

# Linux
wget https://github.com/getsops/sops/releases/download/v3.8.0/sops-v3.8.0.linux.amd64
chmod +x sops-v3.8.0.linux.amd64
mv sops-v3.8.0.linux.amd64 /usr/local/bin/sops

Basic Usage

# Encrypt with AWS KMS
sops --encrypt --kms arn:aws:kms:region:account:key/key-id secrets.yaml > secrets.enc.yaml

# Decrypt
sops --decrypt secrets.enc.yaml

# Edit encrypted file
sops secrets.enc.yaml

# Encrypt in place
sops --encrypt --in-place secrets.yaml

Configuration

# .sops.yaml
creation_rules:
  - path_regex: .*\.prod\.yaml$
    kms: arn:aws:kms:us-east-1:account:key/prod-key
  - path_regex: .*\.dev\.yaml$
    kms: arn:aws:kms:us-east-1:account:key/dev-key
  - path_regex: .*
    pgp: fingerprint

Kubernetes Integration

# encrypted secret
apiVersion: v1
kind: Secret
metadata:
  name: myapp-secrets
type: Opaque
stringData:
  password: ENC[AES256_GCM,data:encrypted...]
sops:
  kms:
    - arn: arn:aws:kms:region:account:key/key-id

# With ArgoCD
# Install ksops plugin for ArgoCD to decrypt secrets

Best Practices

Store .sops.yaml in repository
Use different keys per environment
Rotate encryption keys regularly
Never commit unencrypted secrets
Use key aliases for readability

Related Skills

hashicorp-vault - Centralized secrets
argocd-gitops - GitOps integration

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: sops-encryptiondescription: Encrypt files and configs with Mozilla SOPS. Integrate with AWS KMS, GCP KMS, or PGP for key management. Use when encrypting configuration files, Kubernetes secrets, or implementing GitOps with encrypted secrets. Use when this capability is needed.---# SOPS EncryptionEncrypt secrets in configuration files while keeping structure visible.## When to Use This SkillUse this skill when:- Encrypting secrets in Git- Implementing GitOps with secrets- Managing Kubernetes secrets as code- Encrypting configuration files## Prerequisites- SOPS installed- KMS access (AWS, GCP, Azure) or PGP key## Installation```bash# macOSbrew install sops# Linuxwget https://github.com/getsops/sops/releases/download/v3.8.0/sops-v3.8.0.linux.amd64chmod +x sops-v3.8.0.linux.amd64mv sops-v3.8.0.linux.amd64 /usr/local/bin/sops```## Basic Usage```bash# Encrypt with AWS KMSsops --encrypt --kms arn:aws:kms:region:account:key/key-id secrets.yaml > secrets.enc.yaml# Decryptsops --decrypt secrets.enc.yaml# Edit encrypted filesops secrets.enc.yaml# Encrypt in placesops --encrypt --in-place secrets.yaml```## Configuration```yaml# .sops.yamlcreation_rules: - path_regex: .*\.prod\.yaml$ kms: arn:aws:kms:us-east-1:account:key/prod-key - path_regex: .*\.dev\.yaml$ kms: arn:aws:kms:us-east-1:account:key/dev-key - path_regex: .* pgp: fingerprint```## Kubernetes Integration```yaml# encrypted secretapiVersion: v1kind: Secretmetadata: name: myapp-secretstype: OpaquestringData: password: ENC[AES256_GCM,data:encrypted...]sops: kms: - arn: arn:aws:kms:region:account:key/key-id``````bash# With ArgoCD# Install ksops plugin for ArgoCD to decrypt secrets```## Best Practices- Store .sops.yaml in repository- Use different keys per environment- Rotate encryption keys regularly- Never commit unencrypted secrets- Use key aliases for readability## Related Skills- [hashicorp-vault](../hashicorp-vault/) - Centralized secrets- [argocd-gitops](../../../devops/orchestration/argocd-gitops/) - GitOps integration---> Converted and distributed by [TomeVault](https://tomevault.io/claim/bagelhole) — claim your Tome and manage your conversions.

Frequently asked questions