Skip to main content
In this guide, you’ll learn how to generate an OpenPGP key pair using gpg, export the keys for use with Mozilla SOPS and FluxCD, and then securely clean up local key material. This workflow enables encrypted secrets in GitOps pipelines, ensuring that only Flux can decrypt them in-cluster.

​
1. Install & Review GPG

First, confirm that gpg is installed:
Then inspect common OpenPGP options:
You can run gpg --help for a full list of options. Use --openpgp to enforce strict OpenPGP behavior.

​
2. Generate a GPG Key Pair

Create a 3072-bit RSA primary key and subkey with no passphrase or expiration. Replace the real name, email, and comment as needed:
When complete, note the Key Fingerprint in the output (e.g., 65DD426C08931CDEB33F4DCCE248B2366542A). You’ll use this in subsequent commands.

​
3. List and Verify Your Keys

View all public keys:
Sample output:
To filter by fingerprint:
And list secret keys:

​
4. Export Keys for SOPS & Flux

​
4.1 Export the Private Key

Keep sops-gpg.key confidential. This private key will be stored in-cluster as a Kubernetes secret. Never commit it to Git.

​
4.2 Export the Public Key

Prepare a directory in your Git repository for the public key:
Commit sops-gpg.pub so that developers can encrypt secrets:

​
5. Create a Kubernetes Secret for Flux

Import the private key into the flux-system namespace:
Verify the secret:
FluxCD will mount this secret to decrypt any SOPS-encrypted manifests in Git.

​
6. Clean Up Local GPG Material

Once the keys are exported and stored:
Confirm deletion:

​
7. Summary

You have successfully:
  1. Generated a 3072-bit OpenPGP key pair without passphrase or expiry.
  2. Exported and committed the public key for developer usage.
  3. Created a Kubernetes secret containing the private key for FluxCD.
  4. Cleared all local key material to maintain security.
You’re now ready to encrypt secrets with sops-gpg.pub in your GitOps repository—Flux will automatically decrypt them in-cluster.

Watch Video