sops commands

4 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 4 shown

  • Encrypt in place with age
    SOPS_AGE_RECIPIENTS=age1<id> sops -e -i secrets.yaml

    Encrypt only values in place; note: keys stay readable so diffs stay reviewable

    secrets · security · gitops

  • Re-encrypt to new recipients
    sops updatekeys secrets.yaml

    Rotate data key to recipients in .sops.yaml without re-encrypting plaintext manually

    secrets · security · gitops

  • Run command with decrypted env
    sops exec-env secrets.enc.yaml 'terraform apply'

    Inject decrypted secrets as env vars for one command; note: nothing hits disk

    secrets · ci · security

  • Surgical value edit
    sops --set '["db"]["password"] "s3cr3t"' secrets.enc.yaml

    Set a single nested key without opening an editor; great for scripted rotation

    secrets · ci · troubleshooting