Skip to main content
In this walkthrough you’ll perform the cluster-administrator tasks required to enable SOPS decryption by Flux:
  • Generate a GPG keypair (public + private).
  • Export the public key into your Git repository so developers can encrypt secrets.
  • Store the private key as a Kubernetes Secret so Flux (or another controller) can decrypt SOPS-encrypted resources.
Follow the numbered steps below. Replace example names, emails, and paths with values appropriate for your environment.
Never commit private keys to Git. Only the public key is suitable for a repository. Protect private keys — restrict access to cluster administrators or a secure key management system.

​
Summary of generated artifacts

  • gpg (GnuPG) installed on the admin workstation.
  • kubectl configured with cluster admin privileges.
  • Familiarity with SOPS and Flux: see Mozilla SOPS and Flux docs below.
References:

​
1) Generate a GPG keypair (non-interactive)

Create an RSA 3072-bit keypair without a passphrase for automated use. This example uses a non-interactive batch heredoc. Adjust Name-Real, Name-Email, and Name-Comment for your environment.
Typical initialization output (directory creation and key creation):
Note the key identifier (commonly a 16-character key ID) such as CE284BB23665E42A. You can also use the full 40-character fingerprint for unambiguous references.

​
2) Verify the generated keys

List the public key (use the 16-character key ID or full fingerprint):
Example output:
List secret (private) keys:
Example output:
  • sec indicates a secret (private) key.
  • pub indicates a public key entry.

​
3) Export the private key (for storing into the cluster)

Export the private key in ASCII-armored format to a file (for example sops-gpg.key). Keep this file secure and never commit it to source control.
Verify the private key file exists:

​
4) Export the public key (to commit to Git)

Export the public key in ASCII-armored format and place it in your repository (for example sops/sops-gpg.pub). This public key is what developers use to encrypt secrets.
Now commit sops-gpg.pub to your Git repository so application teams can use it to encrypt secrets.

​
5) Create a Kubernetes Secret containing the private key (Flux will use this for decryption)

Before running the command below, ensure you are targeting the correct cluster and namespace.
Storing private keys in Kubernetes requires careful RBAC and etcd access controls. Ensure only authorized controllers and admins can read this Secret. Never store the private key in Git.
Create a Secret named sops-gpg in the flux-system namespace from the private key file and name the key inside the Secret sops.asc:
Notes:
  • The sops.asc filename inside the Secret is a common convention; Flux’s SOPS integration can be configured to look for this filename.
  • Kubernetes Secrets are base64-encoded objects in etcd — secure etcd and RBAC accordingly.

​
6) (Optional) Delete the local keys from the GPG keyring

If you want to remove the keys from the admin workstation after exporting them, delete the secret and public keys by fingerprint. Interactive deletion:
Non-interactive deletion (use with caution):
Example interactive deletion output:
After deletion, listing by the key ID will produce errors indicating the key no longer exists locally:

​
7) Commit the public key to Git

Commit the sops-gpg.pub file to your repository so developers and CI pipelines can encrypt secrets using the public key:
Final notes
  • Admin workflow summary:
    • Admin generates the GPG keypair.
    • Public key is committed to Git for developers to encrypt secrets.
    • Private key is stored as a Kubernetes Secret for Flux to decrypt SOPS-encrypted manifests at apply time.
    • Optionally remove local key material once exported and stored securely.
  • This article covers the administrator side only. It does not cover developer-side encryption with sops or Flux’s runtime decryption behavior. For those topics, see:

Watch Video