SOPS

What it is

SOPS (Secrets OPerationS) is a CLI tool and library for encrypting values inside structured files — YAML, JSON, ENV, INI, and binary blobs — while leaving the file structure readable. Instead of encrypting the whole file, it encrypts just the values, so you can still diff, review, and grep your secrets files in git without exposing the actual secret content. It supports multiple key management backends: AWS KMS, GCP KMS, Azure Key Vault, age, and PGP, and you can use several at once for the same file (multi-key encryption), which matters if you need different teams or environments to decrypt with different keys.

It's the de facto standard for "secrets in git" workflows in the Kubernetes ecosystem, commonly paired with GitOps tools like Flux (which has native SOPS support) or used standalone in Terraform and Helm pipelines.

Who builds it and why

SOPS was originally created by Mozilla, then donated to CNCF where it now sits in the Sandbox tier. It's maintained by a community of contributors (208 on GitHub) rather than a single vendor — there's no company selling a commercial version or hosted SaaS layer on top of it. The motivation is straightforward: teams need to store secrets in version control safely, and full-file encryption tools break diffing and code review. SOPS solves a narrow, well-defined problem and hasn't tried to expand much beyond it.

Production readiness signal

22,256 GitHub stars and 208 contributors indicate broad adoption, and the project is actively maintained — recent commit activity through mid-2026 shows it's not stale. Current release is v3.13.2, suggesting a mature, iterative versioning cadence rather than churn-heavy major rewrites.

That said, it's still CNCF Sandbox, not Incubating or Graduated. Sandbox status reflects early-stage governance maturity (fewer formal processes, security audits, adopter documentation) even though the tool itself is widely used in production. Treat this as: technically stable, organizationally early-stage. The MPL-2.0 license is permissive enough for commercial use without much friction.

Who should use this

• Teams doing GitOps who need to commit secrets to git alongside config, and want native Flux/Kustomize integration.
• Anyone who wants encryption tied to existing KMS infrastructure (AWS/GCP/Azure) instead of standing up a new secrets service.
• Small-to-mid platform teams that want file-level secret encryption without deploying and operating a full secrets management system like Vault.
• Organizations already using age or PGP for other purposes and want a consistent key story.

Who should NOT use this

• Teams needing dynamic secrets, leasing, or automatic rotation — SOPS is static file encryption, not a secrets engine. Use Vault or a cloud secrets manager instead.
• Anyone needing fine-grained runtime access control or audit logging per secret access — SOPS has no concept of "who read this secret and when" beyond your KMS/git audit trail.
• Environments where key management itself is the hard problem — SOPS doesn't solve key distribution or rotation policy for you; you still need to design that.
• Teams wanting a UI or centralized secrets dashboard — this is a CLI/library tool, full stop.
• If your org already has Vault or a cloud-native secrets manager deeply integrated, adding SOPS on top just for git storage is often redundant complexity.

Alternatives

• HashiCorp Vault — full secrets lifecycle management with dynamic secrets, leasing, and access policies; heavier to operate but far more capable.
• Sealed Secrets (Bitnami) — Kubernetes-native, encrypts secrets so only the target cluster's controller can decrypt them; simpler mental model for pure K8s use cases but less flexible outside the cluster.
• age (standalone) — if you don't need SOPS's structured-file awareness and just want simple, modern file encryption, age alone is lighter weight.

Pricing

Fully open source, MPL-2.0 licensed. No paid tier, no hosted offering, no vendor. You pay only for whatever KMS backend you choose to use (AWS KMS, GCP KMS, Azure Key Vault costs), and SOPS itself is free.