What it is

SOPS, short for Secrets OPerationS, is an editor of encrypted files written in Go and released under the Mozilla Public License Version 2.0. It handles YAML, JSON, ENV, INI and BINARY formats, and it encrypts those files using AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, or PGP. The project lives in the cloud-native infrastructure ecosystem: it started at Mozilla in 2015, was donated to the Cloud Native Computing Foundation in 2023, and is now a CNCF Sandbox project under a new group of maintainers. It carries 23,121 stars and 1,080 forks, with documentation hosted at getsops.io.

The concrete problem it solves is that configuration files frequently contain secrets, and storing those files in plaintext in a repository exposes credentials to anyone who can read the repository. SOPS keeps the file structure readable — keys stay visible, values stay encrypted — so a team can commit configuration to version control while the sensitive values remain protected. It replaces the practice of hand-managing PGP-encrypted files, and it was inspired by earlier tools including hiera-eyaml, credstash, sneaker and password store.

Key capabilities

• Encrypts and edits files in YAML, JSON, ENV, INI and BINARY formats.
• Encrypts values through AWS KMS, GCP KMS, Azure Key Vault and HuaweiCloud KMS key services.
• Supports age and PGP as encryption backends alongside the cloud key services.
• Keeps file structure intact so only values are encrypted, not the whole document.
• Provides a documentation set published at getsops.io under the "Docs" section.
• Accepts private security reports through GitHub's advisory form.
• Distributed as a Go module importable as github.com/getsops/sops/v3.

Who uses it and how

• Teams commit encrypted configuration files to version control and decrypt them at deploy time.
• Operators use cloud KMS keys so access to secrets follows existing cloud identity and key policies.
• Users of age or PGP encrypt files without depending on a cloud key service.
• DevOps and security workflows listed in the project topics cover secret management and secret distribution.
• Environments spanning AWS, Azure and GCP use one tool across all three providers.

Getting started

The README does not list package managers, container image names or a hosted service; it directs readers to the SOPS documentation on getsops.io under the "Docs" section for installation and usage. The project is also published as the Go module github.com/getsops/sops/v3.

When to use it — and when not to

SOPS fits teams that already hold keys in AWS KMS, GCP KMS, Azure Key Vault