ksops
A SOPS companion CLI for editing, validating, and rekeying Kubernetes secrets.
ksops does not replace SOPS. It uses the sops binary for encryption, decryption,
editing, and key updates, while adding small GitOps-oriented workflows around it.
Why ksops?
sops is excellent at encrypting files with age, GPG, KMS, and cloud key services.
But Kubernetes secret repos often need repeatable project workflows around that core.
ksops is a DX layer on top of sops for Kubernetes/GitOps repositories:
| sops | ksops | |
|---|---|---|
| Encrypt files for GitOps | ✅ | ✅ (via sops) |
| Edit encrypted files | ✅ | ✅ ksops edit |
| Decrypt to stdout | ✅ | ✅ ksops cat |
| Decrypt all encrypted manifests | ❌ | ✅ ksops decrypt-all |
| Initialize Kubernetes Secret defaults | ❌ | ✅ ksops init |
| Encrypt all plaintext Secret manifests | ❌ | ✅ ksops encrypt-all |
Rekey one file from .sops.yaml |
✅ sops updatekeys |
✅ ksops rekey |
| Rekey all encrypted manifests | ❌ | ✅ ksops rekey-all |
| Check plaintext Kubernetes Secret leaks | ❌ | ✅ ksops validate-all |
Commands
ksops init --age age1...
ksops edit secret.yaml
ksops cat secret.yaml
ksops encrypt secret.yaml --in-place
ksops encrypt-all ./manifests
ksops decrypt secret.yaml
ksops decrypt-all ./manifests
ksops rekey secret.yaml
ksops rekey-all ./manifests
ksops validate-all ./manifests
ksops completion zsh
Configuration
Encryption policy stays in native .sops.yaml.
creation_rules:
- path_regex: .*secret.*\.ya?ml$
encrypted_regex: ^(data|stringData)$
age: age1...
ksops init --age age1... creates a starter .sops.yaml, but all encryption
behavior is still handled by SOPS itself.
Shell Completion
source <(ksops completion bash)
source <(ksops completion zsh)
1 maintainer
Metadata
1 maintainer
Release files for ksops 0.2.2
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| ksops-0.2.2.tar.gz | 25.5 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| ksops-0.2.2-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 32.2 kB
Release files / ksops-0.2.2.tar.gz
| Download URL | ksops-0.2.2.tar.gz |
|---|---|
| Size | 25.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
b14a932403a760ead3ef993620c3867099e3a5e70ae6b9c9986b3e2a53606e3c
|
|
BLAKE2b-256 checksum How to use checksums |
48c1cd3ba08fac86f26ef50a6775486df1750c06c9d6f1be0b8e284fbb06975a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.11.13 {"installer":{"name":"uv","version":"0.11.13","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Release files / ksops-0.2.2-py3-none-any.whl
| Download URL | ksops-0.2.2-py3-none-any.whl |
|---|---|
| Size | 6.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
8a6cbe5326f83ea14cbba469f2ed9458fcc733bb2c9eb9553fe1aeece83d109a
|
|
BLAKE2b-256 checksum How to use checksums |
89f8b7a1b4ae9c66a41ab2abf6354a8a06aa05e7fcf17f866dc070d9c623bf00
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.11.13 {"installer":{"name":"uv","version":"0.11.13","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
