Can Kubernetes Applications read the encrypted files created by SOPs or do they need to be decrypted before usage?

[Plus3IT-Azure]

Hello, the title pretty much explains everything. A K8s secret can be pulled via a K8s deployment yaml file, i'm curious if I can leave the K8s secret yaml encrypted (via SOPs) or does it need to be unencrypted for my deployment to read the data in the file?

[kokoc30]

A normal Kubernetes Secret volume or secretKeyRef does not decrypt SOPS ciphertext. The manifest needs to be decrypted before the Secret is created/updated in the Kubernetes API. After that, your Deployment references the resulting Secret normally.

You can keep the encrypted manifest in Git and decrypt it during deployment, for example with SOPS credentials already configured:

sops decrypt secret.sops.yaml | kubectl apply -f -

sops decrypt outputs the decrypted manifest to stdout, so this does not require saving a separate plaintext manifest. Run it in the trusted deployment environment and avoid logging the decrypted output.

For GitOps, an integration such as Flux's SOPS decryption performs that step in the cluster: kustomize-controller gets decryption access, decrypts the manifest, then applies the Secret. The application's Pod does not need the SOPS key merely to consume that Secret.

Putting ENC[...] directly in stringData would just deliver that ciphertext as the application value. Putting it directly in data would fail that field's base64 requirements. Kubernetes Secret data constraints.

SOPS protects the manifest stored outside the API; protection of the resulting Kubernetes Secret, including access controls and encryption at rest, is a separate cluster concern.

[Dexmachi]

You can simply use flux to sync them together, it isn't really hard, but you'll need to deal with GitOps if you don't already use it