> ## Documentation Index > Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Demo Mozilla SOPS Admin > Walkthrough for cluster administrators to create a GPG keypair, commit the public key to Git, and store the private key as a Kubernetes Secret for Flux SOPS decryption. In this walkthrough you'll perform the cluster-administrator tasks required to enable SOPS decryption by Flux: * Generate a GPG keypair (public + private). * Export the public key into your Git repository so developers can encrypt secrets. * Store the private key as a Kubernetes Secret so Flux (or another controller) can decrypt SOPS-encrypted resources. Follow the numbered steps below. Replace example names, emails, and paths with values appropriate for your environment. Never commit private keys to Git. Only the public key is suitable for a repository. Protect private keys — restrict access to cluster administrators or a secure key management system. ## Summary of generated artifacts | Artifact | Purpose | Example filename / name | | -: | - | - | | GPG keypair | Encrypt/decrypt SOPS secrets | generated locally | | Public key (ASCII) | Commit to Git for developers to encrypt secrets | `sops-gpg.pub` | | Private key (ASCII) | Stored in cluster for Flux to decrypt | `sops-gpg.key` / Kubernetes Secret `sops-gpg` | | Kubernetes Secret | Flux reads this to decrypt SOPS-encrypted manifests | `kubectl -n flux-system create secret generic sops-gpg ...` | ## Prerequisites & links * gpg (GnuPG) installed on the admin workstation. * kubectl configured with cluster admin privileges. * Familiarity with SOPS and Flux: see Mozilla SOPS and Flux docs below. References: * Mozilla SOPS: [https://github.com/mozilla/sops](https://github.com/mozilla/sops) * Flux SOPS integration: [https://fluxcd.io/docs/guides/mozilla-sops/](https://fluxcd.io/docs/guides/mozilla-sops/) * Kubernetes Secrets: [https://kubernetes.io/docs/concepts/configuration/secret/](https://kubernetes.io/docs/concepts/configuration/secret/) * GnuPG documentation: [https://gnupg.org/documentation/](https://gnupg.org/documentation/) *** ## 1) Generate a GPG keypair (non-interactive) Create an RSA 3072-bit keypair without a passphrase for automated use. This example uses a non-interactive batch heredoc. Adjust `Name-Real`, `Name-Email`, and `Name-Comment` for your environment. ```bash theme={null} gpg --batch --full-generate-key <<'EOF' %no-protection Key-Type: 1 Key-Length: 3072 Subkey-Type: 1 Subkey-Length: 3072 Expire-Date: 0 Name-Comment: k8s Name-Real: dev.us-e1.k8s Name-Email: admin@bb.com EOF ``` Typical initialization output (directory creation and key creation): ```text theme={null} gpg: directory '/home/batman/.gnupg' created gpg: keybox '/home/batman/.gnupg/pubring.kbx' created gpg: /home/batman/.gnupg/trustdb.gpg: trustdb created gpg: key CE284BB23665E42A marked as ultimately trusted gpg: directory '/home/batman/.gnupg/openpgp-revocs.d' created gpg: revocation certificate stored as '/home/batman/.gnupg/openpgp-revocs.d/65DD426CB98391CDEB33FD4CCE284BB23665E42A.rev' ``` Note the key identifier (commonly a 16-character key ID) such as `CE284BB23665E42A`. You can also use the full 40-character fingerprint for unambiguous references. ## 2) Verify the generated keys List the public key (use the 16-character key ID or full fingerprint): ```bash theme={null} gpg --list-public-keys CE284BB23665E42A ``` Example output: ```text theme={null} pub rsa3072 2023-04-06 [SCEA] 65DD426CB98391CDEB33FD4CCE284BB23665E42A uid [ultimate] dev.us-e1.k8s (k8s) sub rsa3072 2023-04-06 [SEA] ``` List secret (private) keys: ```bash theme={null} gpg --list-secret-keys ``` Example output: ```text theme={null} /home/batman/.gnupg/pubring.kbx ------------------------------ sec rsa3072 2023-04-06 [SCEA] 65DD426CB98391CDEB33FD4CCE284BB23665E42A uid [ultimate] dev.us-e1.k8s (k8s) ssb rsa3072 2023-04-06 [SEA] ``` * `sec` indicates a secret (private) key. * `pub` indicates a public key entry. ## 3) Export the private key (for storing into the cluster) Export the private key in ASCII-armored format to a file (for example `sops-gpg.key`). Keep this file secure and never commit it to source control. ```bash theme={null} # From the directory where you want to save the private key (example: home) gpg --export-secret-keys --armor CE284BB23665E42A > ~/sops-gpg.key ``` Verify the private key file exists: ```bash theme={null} ls -l ~/sops-gpg.key ``` ## 4) Export the public key (to commit to Git) Export the public key in ASCII-armored format and place it in your repository (for example `sops/sops-gpg.pub`). This public key is what developers use to encrypt secrets. ```bash theme={null} # From the repo path, e.g., ~/bb-app-source/sops gpg --export --armor CE284BB23665E42A > sops-gpg.pub ``` Now commit `sops-gpg.pub` to your Git repository so application teams can use it to encrypt secrets. ## 5) Create a Kubernetes Secret containing the private key (Flux will use this for decryption) Before running the command below, ensure you are targeting the correct cluster and namespace. Storing private keys in Kubernetes requires careful RBAC and etcd access controls. Ensure only authorized controllers and admins can read this Secret. Never store the private key in Git. Create a Secret named `sops-gpg` in the `flux-system` namespace from the private key file and name the key inside the Secret `sops.asc`: ```bash theme={null} kubectl -n flux-system create secret generic sops-gpg --from-file=sops.asc=~/sops-gpg.key ``` Notes: * The `sops.asc` filename inside the Secret is a common convention; Flux’s SOPS integration can be configured to look for this filename. * Kubernetes Secrets are base64-encoded objects in etcd — secure etcd and RBAC accordingly. ## 6) (Optional) Delete the local keys from the GPG keyring If you want to remove the keys from the admin workstation after exporting them, delete the secret and public keys by fingerprint. Interactive deletion: ```bash theme={null} gpg --delete-secret-keys CE284BB23665E42A gpg --delete-keys CE284BB23665E42A ``` Non-interactive deletion (use with caution): ```bash theme={null} gpg --batch --yes --delete-secret-keys CE284BB23665E42A gpg --batch --yes --delete-keys CE284BB23665E42A ``` Example interactive deletion output: ```text theme={null} Delete this key from the keyring? (y/N) y This is a secret key! - really delete? (y/N) y pub rsa3072/CE284BB23665E42A 2023-04-06 dev.us-e1.k8s (k8s) Delete this key from the keyring? (y/N) y ``` After deletion, listing by the key ID will produce errors indicating the key no longer exists locally: ```bash theme={null} gpg --list-secret-keys CE284BB23665E42A gpg --list-public-keys CE284BB23665E42A # -> gpg: error reading key: No public key ``` ## 7) Commit the public key to Git Commit the `sops-gpg.pub` file to your repository so developers and CI pipelines can encrypt secrets using the public key: ```bash theme={null} cd ~/bb-app-source git add sops/sops-gpg.pub git commit -m "Add SOPS public key for dev.us-e1.k8s" git push ``` *** Final notes * Admin workflow summary: * Admin generates the GPG keypair. * Public key is committed to Git for developers to encrypt secrets. * Private key is stored as a Kubernetes Secret for Flux to decrypt SOPS-encrypted manifests at apply time. * Optionally remove local key material once exported and stored securely. * This article covers the administrator side only. It does not cover developer-side encryption with `sops` or Flux’s runtime decryption behavior. For those topics, see: * Flux SOPS integration: [https://fluxcd.io/docs/guides/mozilla-sops/](https://fluxcd.io/docs/guides/mozilla-sops/) * Mozilla SOPS: [https://github.com/mozilla/sops](https://github.com/mozilla/sops) > **[Watch Video](https://learn.kodekloud.com/user/courses/gitops-with-fluxcd/module/c8ad2608-2804-4413-9041-5e8dc9126d53/lesson/1f64b743-b032-46e6-af75-c00467869125)** This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.