Automating Key Management with SOPS and GitOps

In modern software development, managing sensitive data such as encryption keys, certificates, and passwords is a critical task. Manual key management can lead to security breaches, compliance issues, and operational inefficiencies. To address these challenges, we can automate key management using SOPS (Secrets OPerationS) and GitOps.

SOPS Overview

SOPS is an open-source tool for managing sensitive data in a secure and auditable way. It provides a simple, yet powerful, way to store, manage, and retrieve secrets. SOPS uses a YAML-based configuration file to define secrets, which can be encrypted using various encryption algorithms, such as AWS KMS, Google Cloud KMS, or HashiCorp's Vault.

GitOps Overview

GitOps is a set of practices that combines Git version control with infrastructure automation. It enables infrastructure-as-code (IaC) management, where infrastructure configurations are stored in a Git repository and automatically applied to the target environment. GitOps tools, such as Flux or Argo CD, provide a declarative way to manage infrastructure and applications.

Automating Key Management with SOPS and GitOps

To automate key management, we will integrate SOPS with a GitOps workflow. This integration enables secure, version-controlled, and auditable key management.

Step 1: Create a SOPS Configuration File

First, we create a SOPS configuration file (sops.yaml) that defines our secrets:

secrets:
  - name: my-secret
    type: aws_kms
    key_id: "arn:aws:kms:us-west-2:123456789012:key/12345678-1234-1234-1234-123456789012"
    encrypted: |
      AQICAHh... (encrypted secret value)

In this example, we define a single secret named my-secret with an AWS KMS key ID.

Step 2: Store the SOPS Configuration File in a Git Repository

Next, we store the sops.yaml file in a Git repository, which will serve as the single source of truth for our secrets:

git init
git add sops.yaml
git commit -m "Initial commit"

Step 3: Configure GitOps

We configure a GitOps tool, such as Flux, to manage our infrastructure and applications. In this example, we use Flux to deploy a Kubernetes cluster:

apiVersion: flux.weave.works/v1beta1
kind: GitRepository
metadata:
  name: sops-repo
spec:
  url: https://github.com/my-org/sops-repo
  interval: 1m

This configuration defines a Git repository named sops-repo that will be polled every minute for changes.

Step 4: Integrate SOPS with GitOps

To integrate SOPS with GitOps, we create a Flux HelmRelease that deploys a SOPS-enabled application:

apiVersion: helm.fluxcd.io/v1
kind: HelmRelease
metadata:
  name: sops-app
spec:
  chart:
    git:
      repo:
        url: https://github.com/my-org/sops-repo
        ref:
          branch: main
    version: 1.0.0
  values:
    sops:
      config: sops.yaml

This configuration defines a HelmRelease named sops-app that deploys a SOPS-enabled application using the sops.yaml file from the Git repository.

Step 5: Automate Key Management

With the integration in place, any changes to the sops.yaml file in the Git repository will trigger an automated deployment of the SOPS-enabled application. This ensures that our secrets are always up-to-date and securely managed.

By automating key management with SOPS and GitOps, we can ensure secure, version-controlled, and auditable management of sensitive data. This approach enables platform engineering teams to focus on delivering value-added services while minimizing the risk of security breaches and compliance issues.

Conclusion

In this article, we demonstrated how to automate key management using SOPS and GitOps. By integrating these tools, we can ensure secure, version-controlled, and auditable management of sensitive data. This approach enables organizations to improve their security posture, reduce operational inefficiencies, and increase compliance.