sops-encryption — Claude Code skill: SOPS secret encryption
A skill that walks your agent through encrypting configs and Kubernetes secrets with Mozilla SOPS, using AWS KMS, GCP KMS or PGP keys. Useful when secrets live in Git.
npx skills add BagelHole/DevOps-Security-Agent-Skills --skill sops-encryption -a claude-codeWhat sops-encryption does
The skill covers Mozilla SOPS: encrypting values inside config files while the structure stays readable. Your agent gets the commands — encrypt a file, decrypt it, edit an encrypted file, encrypt in place.
It ships a .sops.yaml template with path-based rules: one key for prod files, another for dev, PGP as a fallback. A separate section handles Kubernetes secrets — a Secret manifest with a sops block and values like ENC[AES256_GCM,...] — plus installing the ksops plugin so ArgoCD decrypts them on its own.
You need SOPS installed and access to KMS (AWS, GCP or Azure) or a PGP key. Without a key-management backend the encrypt commands simply fail. The skill also advises keeping .sops.yaml in the repo and never committing plaintext secrets, which is a good reason to check your Git history today.
What it helps with
- encrypt secrets in a config without hiding the file structure
- keep Kubernetes secrets in Git as code
- use separate encryption keys for prod and dev
- wire ArgoCD to decrypt secrets via the ksops plugin
- edit an encrypted file without dumping plaintext to disk
Example prompts for the agent
- encrypt secrets.yaml with SOPS using my AWS KMS key
- set up .sops.yaml so .prod.yaml uses a separate KMS key
- encrypt this Kubernetes secret and show how ArgoCD will pick it up
How to install sops-encryption
1Skills CLI (Vercel)
npx skills add BagelHole/DevOps-Security-Agent-Skills --skill sops-encryption -a claude-code2Manually: put the files in place
~/.claude/skills/sops-encryption/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/sops-encryption/
1Skills CLI (Vercel)
npx skills add BagelHole/DevOps-Security-Agent-Skills --skill sops-encryption -a codex2Manually: put the files in place
.agents/skills/sops-encryption/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add BagelHole/DevOps-Security-Agent-Skills --skill sops-encryption -a cursor2Manually: put the files in place
.cursor/skills/sops-encryption/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install BagelHole/DevOps-Security-Agent-Skills sops-encryption2Manually: put the files in place
.github/skills/sops-encryption/SKILL.md1Skills CLI (Vercel)
npx skills add BagelHole/DevOps-Security-Agent-Skills --skill sops-encryption -a gemini-cli2Platform CLI
gemini skills install https://github.com/BagelHole/DevOps-Security-Agent-Skills --path security/secrets/sops-encryptionManually: put the files in place
.devin/skills/sops-encryption/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add BagelHole/DevOps-Security-Agent-Skills --skill sops-encryption -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about sops-encryption
How do I install sops-encryption in Claude?
Run npx skills add BagelHole/DevOps-Security-Agent-Skills --skill sops-encryption -a claude-code. The skill then sits at ~/.claude/skills/sops-encryption/SKILL.md.
What does sops-encryption do?
It gives the agent instructions for encrypting configs and secrets with Mozilla SOPS using AWS KMS, GCP KMS or PGP keys, including a .sops.yaml template and a Kubernetes Secret manifest.
What do I need before using it?
SOPS installed and access to KMS (AWS, GCP or Azure) or a PGP key. Without a key backend the encryption commands will not run.
Source text
SKILL.md · MIT
---
name: sops-encryption
description: Encrypt files and configs with Mozilla SOPS. Integrate with AWS KMS, GCP KMS, or PGP for key management. Use when encrypting configuration files, Kubernetes secrets, or implementing GitOps with encrypted secrets.
license: MIT
metadata:
author: devops-skills
version: "1.0"
---
# SOPS Encryption
Encrypt secrets in configuration files while keeping structure visible.
## When to Use This Skill
Use this skill when:
- Encrypting secrets in Git
- Implementing GitOps with secrets
- Managing Kubernetes secrets as code
- Encrypting configuration files
## Prerequisites
- SOPS installed
- KMS access (AWS, GCP, Azure) or PGP key
## Installation
```bash
# macOS
brew install sops
# Linux
wget https://github.com/getsops/sops/releases/download/v3.8.0/sops-v3.8.0.linux.amd64
chmod +x sops-v3.8.0.linux.amd64
mv sops-v3.8.0.linux.amd64 /usr/local/bin/sops
```
## Basic Usage
```bash
# Encrypt with AWS KMS
sops --encrypt --kms arn:aws:kms:region:account:key/key-id secrets.yaml > secrets.enc.yaml
# Decrypt
sops --decrypt secrets.enc.yaml
# Edit encrypted file
sops secrets.enc.yaml
# Encrypt in place
sops --encrypt --in-place secrets.yaml
```
## Configuration
```yaml
# .sops.yaml
creation_rules:
- path_regex: .*\.prod\.yaml$
kms: arn:aws:kms:us-east-1:account:key/prod-key
- path_regex: .*\.dev\.yaml$
kms: arn:aws:kms:us-east-1:account:key/dev-key
- path_regex: .*
pgp: fingerprint
```
## Kubernetes Integration
```yaml
# encrypted secret
apiVersion: v1
kind: Secret
metadata:
name: myapp-secrets
type: Opaque
stringData:
password: ENC[AES256_GCM,data:encrypted...]
sops:
kms:
- arn: arn:aws:kms:region:account:key/key-id
```
```bash
# With ArgoCD
# Install ksops plugin for ArgoCD to decrypt secrets
```
## Best Practices
- Store .sops.yaml in repository
- Use different keys per environment
- Rotate encryption keys regularly
- Never commit unencrypted secrets
- Use key aliases for readability
## Related Skills
- [hashicorp-vault](../hashicorp-vault/) - Centralized secrets
- [argocd-gitops](../../../devops/orchestration/argocd-gitops/) - GitOps integration
© devops-skills · MIT · BagelHole/DevOps-Security-Agent-Skills
