SOPS

Mozilla engineers created SOPS in 2015 to handle encrypted configuration in Git without exposing plaintext credentials. By encrypting values in YAML and JSON while leaving keys visible, it tracks secret changes cleanly across version control history. Now a CNCF sandbox project, SOPS anchors file-based encryption across modern infrastructure pipelines.

Why SOPS instead of Doppler

Doppler acts as a centralized secrets hub, syncing credentials into local environments, CI pipelines, and production servers through a cloud dashboard and agent. This removes plaintext files from developer machines but introduces an external runtime dependency and charges per-seat subscriptions.

SOPS embeds encrypted secret files directly alongside code, Terraform modules, and Kubernetes manifests. Instead of fetching credentials over an external API at runtime, GitOps tools like Flux and Argo CD decrypt files in-cluster using cloud KMS or age keys. Rollbacks in Git instantly restore the exact secrets matching that release. Doppler offers superior dashboard onboarding and automated syncing, whereas SOPS fits teams that want zero SaaS dependencies and secrets versioned directly in Git.

What it does well

• Selective value encryption: Encrypts values in YAML, JSON, ENV, and INI files while leaving keys and structure in plaintext for clear git diffs.
• Multi-provider envelope encryption: Secures a generated data key with AWS KMS, Google Cloud KMS, Azure Key Vault, HashiCorp Vault, age, or PGP.
• Declarative creation rules: Uses .sops.yaml to automatically map file paths to specific KMS ARNs or age public keys across environments.
• Native GitOps controller integration: Decrypts directly inside clusters via Flux CD and Argo CD plugins without intermediate secret storage.
• Cryptographic integrity verification: Computes a message authentication code across keys and values to block unauthorized edits or corrupted commits.
• Threshold key groups: Supports Shamir secret sharing and quorum rules requiring multiple independent keys to authorize decryption.

Limitations

• Git merge conflicts invalidate integrity MACs: Concurrent edits corrupt the file message authentication code, forcing engineers to decrypt both versions locally, resolve conflicts in plaintext, and re-encrypt (GitHub issue #52).