PoC: Storing Secrets Encrypted in Git with SOPS

A proof of concept (PoC) demonstrating how to securely store secrets in a Git repository using SOPS and decrypt them during pipeline execution with GitHub Actions.

Introduction

This project uses SOPS to encrypt sensitive information in Git repositories. The PoC showcases a secure and automated workflow for managing secrets by leveraging SOPS’ encryption capabilities and GitHub Actions.

Diagram

graph TD
    A[Developer] -->|Encrypt Secrets| B[SOPS Encrypted File]
    B -->|Commit to Repo| C[Git Repository]
    C -->|Trigger Pipeline| D[GitHub Actions]
    D -->|Decrypt Secrets| E[Pipeline Execution]

Features

Secure Secret Storage: Encrypt secrets directly within your Git repository to maintain confidentiality.
Automated Decryption: Use GitHub Actions to decrypt secrets during CI/CD pipeline execution securely.
Flexible Encryption: SOPS supports multiple backends, including AWS KMS, GCP KMS, and PGP.
Easy Integration: Minimal setup required to integrate SOPS into existing workflows.

Useful Links

How to Run

Install SOPS: Follow the installation instructions from the SOPS GitHub Repository.

Encrypt a file:

sops --encrypt --encrypted-regex '^(password|secret)$' secrets.yaml > secrets.enc.yaml

Commit the encrypted file to the repository:

git add secrets.enc.yaml
git commit -m "Add encrypted secrets"

Set up GitHub Actions for decryption:
- Configure SOPS to use your desired encryption backend (e.g., AWS KMS, GCP KMS, or PGP).
- Add the necessary keys to your GitHub repository as secrets.
- Use a GitHub Actions workflow to decrypt and use the secrets during pipeline execution.
Run the pipeline: Push changes to trigger the GitHub Actions workflow and observe the decryption process during execution.

License

This project is licensed under the MIT License. Please take a look at the LICENSE file for details.