> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DEMO Mozilla SOPS Admin

> This guide explains generating an OpenPGP key pair for use with Mozilla SOPS and FluxCD, including key management and secure cleanup.

In this guide, you’ll learn how to generate an OpenPGP key pair using `gpg`, export the keys for use with [Mozilla SOPS](https://github.com/mozilla/sops) and [FluxCD](https://fluxcd.io/), and then securely clean up local key material. This workflow enables encrypted secrets in GitOps pipelines, ensuring that only Flux can decrypt them in-cluster.

## 1. Install & Review GPG

First, confirm that `gpg` is installed:

```bash theme={null}
gpg --version
```

Then inspect common OpenPGP options:

| Option               | Description                     | Example                                  |
| -------------------- | ------------------------------- | ---------------------------------------- |
| `-o, --output`       | Write output to a specific file | `gpg -o file.txt --decrypt secret.gpg`   |
| `-s, --sign`         | Create a signature              | `gpg -s document.txt`                    |
| `-e, --encrypt`      | Encrypt for specified recipient | `gpg -e -r alice document.txt`           |
| `--list-keys`        | List public keys                | `gpg --list-keys alice`                  |
| `--list-secret-keys` | List secret keys                | `gpg --list-secret-keys`                 |
| `--armor`            | ASCII-armored output            | `gpg --armor --export alice@example.com` |

<Callout icon="lightbulb" color="#1CB2FE">
  You can run `gpg --help` for a full list of options. Use `--openpgp` to enforce strict OpenPGP behavior.
</Callout>

## 2. Generate a GPG Key Pair

Create a 3072-bit RSA primary key and subkey with no passphrase or expiration. Replace the real name, email, and comment as needed:

```bash theme={null}
gpg --batch --full-generate-key \
  --passphrase '' \
  --key-length 3072 \
  --subkey-length 3072 \
  --exp-date 0 \
  --name-real "dev.us-e1.k8s" \
  --name-email "admin@bb.com" \
  --comment "k8s"
```

When complete, note the **Key Fingerprint** in the output (e.g., `65DD426C08931CDEB33F4DCCE248B2366542A`). You’ll use this in subsequent commands.

## 3. List and Verify Your Keys

View all public keys:

```bash theme={null}
gpg --list-public-keys
```

Sample output:

```text theme={null}
pub   rsa3072 2023-04-06 [SCEA]
      65DD426C08931CDEB33F4DCCE248B2366542A
uid           [ultimate] dev.us-e1.k8s <admin@bb.com>
sub   rsa3072 2023-04-06 [SEA]
```

To filter by fingerprint:

```bash theme={null}
gpg --list-public-keys 65DD426C08931CDEB33F4DCCE248B2366542A
```

And list secret keys:

```bash theme={null}
gpg --list-secret-keys
```

## 4. Export Keys for SOPS & Flux

### 4.1 Export the Private Key

```bash theme={null}
gpg --export-secret-keys --armor 65DD426C08931CDEB33F4DCCE248B2366542A \
  > sops-gpg.key
```

<Callout icon="triangle-alert" color="#FF6B6B">
  Keep `sops-gpg.key` confidential. This private key will be stored in-cluster as a Kubernetes secret. Never commit it to Git.
</Callout>

### 4.2 Export the Public Key

Prepare a directory in your Git repository for the public key:

```bash theme={null}
mkdir -p bb-app-source/sops
cd bb-app-source/sops
gpg --export --armor 65DD426C08931CDEB33F4DCCE248B2366542A \
  > sops-gpg.pub
```

Commit `sops-gpg.pub` so that developers can encrypt secrets:

```bash theme={null}
git add sops-gpg.pub
git commit -m "Add SOPS public key for Flux decryption"
```

## 5. Create a Kubernetes Secret for Flux

Import the private key into the `flux-system` namespace:

```bash theme={null}
kubectl -n flux-system create secret generic sops-gpg \
  --from-file=sops.asc=sops-gpg.key
```

Verify the secret:

```bash theme={null}
kubectl -n flux-system get secret sops-gpg
# NAME      TYPE    DATA   AGE
# sops-gpg  Opaque  1      30s
```

FluxCD will mount this secret to decrypt any SOPS-encrypted manifests in Git.

## 6. Clean Up Local GPG Material

Once the keys are exported and stored:

```bash theme={null}
rm sops-gpg.key

# Remove both public and secret keys from your local keyring:
gpg --delete-secret-and-public-keys 65DD426C08931CDEB33F4DCCE248B2366542A
```

Confirm deletion:

```bash theme={null}
gpg --list-secret-keys 65DD426C08931CDEB33F4DCCE248B2366542A
gpg --list-public-keys 65DD426C08931CDEB33F4DCCE248B2366542A
# gpg: error reading key: No public key
```

## 7. Summary

You have successfully:

1. Generated a 3072-bit OpenPGP key pair without passphrase or expiry.
2. Exported and committed the public key for developer usage.
3. Created a Kubernetes secret containing the private key for FluxCD.
4. Cleared all local key material to maintain security.

You’re now ready to encrypt secrets with `sops-gpg.pub` in your GitOps repository—Flux will automatically decrypt them in-cluster.

## Links and References

* [OpenPGP Official Site](https://www.openpgp.org/)
* [Mozilla SOPS GitHub](https://github.com/mozilla/sops)
* [FluxCD Documentation](https://fluxcd.io/docs/)
* [Kubernetes Secrets](https://kubernetes.io/docs/concepts/configuration/secret/)

<CardGroup>
  <Card title="Watch Video" icon="video" cta="Learn more" href="https://learn.kodekloud.com/user/courses/gitops-with-fluxcd/module/c8ad2608-2804-4413-9041-5e8dc9126d53/lesson/1f64b743-b032-46e6-af75-c00467869125" />
</CardGroup>