ankra-sops-secrets

Encrypt Kubernetes Secrets using SOPS with AGE keys to prevent plaintext leakage in GitOps repositories. Define encrypted_paths metadata on manifests to ensure Ankra selectively decrypts sensitive values at deploy time.

SOPS encrypts Kubernetes Secrets at rest using AGE keys, ensuring plaintext never lands in Git. The encrypted_paths metadata marks which YAML keys are encrypted, enabling selective decryption at deploy time.

Yes, encrypted_paths metadata is required to specify which YAML keys are encrypted. Ankra uses this metadata to selectively decrypt sensitive values in manifests and addons across clusters at deploy time.

Yes, SOPS with AGE supports file-mode and cluster-mode workflows across environments. Integrate with ankra cluster encrypt/decrypt commands to manage secrets for manifests and addons across multiple clusters.

Using SOPS with AGE is an effective approach for GitOps secret management. It encrypts sensitive values before commit and tracks them with encrypted_paths so Ankra decrypts them at deploy time.

SOPS uses AGE keys to encrypt Kubernetes Secrets at rest, preventing plaintext leakage in GitOps repositories. This ensures sensitive values remain encrypted until Ankra decrypts them at deploy time.