sops

Encrypt in place with age Encrypt only values in place; note: keys stay readable so diffs stay reviewable SOPS_AGE_RECIPIENTS=age1<id> sops -e -i secrets.yaml #sops#secrets#security#gitops Re-encrypt to new recipients Rotate data key to recipients in .sops.yaml without re-encrypting plaintext manually sops updatekeys secrets.yaml #sops#secrets#security#gitops Run command with decrypted env Inject decrypted secrets as env vars for one command; note: nothing hits disk sops exec-env secrets.enc.yaml 'terraform apply' #sops#secrets#ci#security Surgical value edit Set a single nested key without opening an editor; great for scripted rotation sops --set '["db"]["password"] "s3cr3t"' secrets.enc.yaml #sops#secrets#ci#troubleshooting