// the find
getsops/sops
Simple and flexible tool for managing secrets
SOPS is the de facto standard tool for encrypting secrets within structured files (YAML, JSON, ENV, INI, binary), backed by AWS KMS, GCP KMS, Azure Key Vault, age, or PGP. It's aimed at teams who need to commit encrypted config/secrets to git and manage access via cloud KMS rather than sharing raw keys.
Multi-backend key management (KMS providers plus age/PGP) means you're not locked into one cloud, and key rotation/re-encryption across multiple recipients is built in. Format-aware encryption only touches values, not keys, so diffs stay readable and merges don't explode. It's been through years of real production use at scale, now under CNCF stewardship with an actual security disclosure process, and the keyservice/gRPC design lets you decouple decryption from key access for CI pipelines.
PGP support is still there for legacy reasons but is genuinely painful to operate (key distribution, revocation, GPG keyring quirks) and the docs don't push people away from it hard enough. No built-in secret rotation reminders or expiry — it just encrypts, leaving lifecycle policy entirely up to you. The .sops.yaml creation-rule matching can get gnarly in monorepos with lots of file path regexes, and misconfiguring it silently means secrets end up unencrypted or encrypted with the wrong key, which is a sharp edge for newcomers.