Encrypt in place with age sops

Encrypt only values in place; note: keys stay readable so diffs stay reviewable

SOPS_AGE_RECIPIENTS=age1<id> sops -e -i secrets.yaml

#sops #secrets #security #gitops

more sops all 4 commands →

Re-encrypt to new recipients sops updatekeys secrets.yaml Run command with decrypted env sops exec-env secrets.enc.yaml 'terraform apply' Surgical value edit sops --set '["db"]["password"] "s3cr3t"' secrets.enc.yaml