How to Implement Secret Encryption with Mozilla SOPS 3.8 and Git for Kubernetes 1.37 Manifests

#!/bin/bash
# sops-setup.sh - Automated setup for SOPS 3.8 + Age + K8s 1.37 manifest encryption
# Requires: bash 4+, curl, git, kubectl 1.37+
set -euo pipefail  # Exit on error, undefined var, pipe failure
IFS=$'\n\t'

# Configuration
SOPS_VERSION="3.8.0"
AGE_VERSION="1.1.1"
KUBECTL_VERSION="1.37.0"
SOPS_GITHUB_REPO="https://github.com/getsops/sops"
AGE_GITHUB_REPO="https://github.com/FiloSottile/age"

# Error handling function
handle_error() {
    local exit_code=$?
    local line_number=$1
    echo "❌ Error occurred at line ${line_number}, exit code ${exit_code}"
    echo "Rolling back partial setup..."
    rm -f ~/.sops* ~/.age* 2>/dev/null || true
    exit $exit_code
}
trap 'handle_error $LINENO' ERR

# Step 1: Install SOPS 3.8
echo "📦 Installing SOPS ${SOPS_VERSION}..."
if ! command -v sops &> /dev/null || ! sops --version | grep -q "3.8.0"; then
    case "$(uname -s)" in
        Linux)
            curl -L -o /tmp/sops "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64"
            sudo mv /tmp/sops /usr/local/bin/sops
            sudo chmod +x /usr/local/bin/sops
            ;;
        Darwin)
            brew install sops 2>/dev/null || brew upgrade sops
            ;;
        *)
            echo "Unsupported OS: $(uname -s)"
            exit 1
            ;;
    esac
    echo "✅ SOPS ${SOPS_VERSION} installed successfully"
else
    echo "✅ SOPS ${SOPS_VERSION} already installed"
fi

# Step 2: Install Age 1.1.1 (SOPS 3.8 default key provider)
echo "📦 Installing Age ${AGE_VERSION}..."
if ! command -v age &> /dev/null || ! age --version | grep -q "1.1.1"; then
    case "$(uname -s)" in
        Linux)
            curl -L -o /tmp/age "https://github.com/FiloSottile/age/releases/download/v${AGE_VERSION}/age-v${AGE_VERSION}-linux-amd64.tar.gz"
            tar -xzf /tmp/age -C /tmp
            sudo mv /tmp/age/age /usr/local/bin/age
            sudo mv /tmp/age/age-keygen /usr/local/bin/age-keygen
            sudo chmod +x /usr/local/bin/age /usr/local/bin/age-keygen
            ;;
        Darwin)
            brew install age 2>/dev/null || brew upgrade age
            ;;
    esac
    echo "✅ Age ${AGE_VERSION} installed successfully"
else
    echo "✅ Age ${AGE_VERSION} already installed"
fi

# Step 3: Generate Age key pair for SOPS
echo "🔑 Generating Age key pair..."
if [ ! -f ~/.age/sops-key.txt ]; then
    mkdir -p ~/.age
    age-keygen -o ~/.age/sops-key.txt
    chmod 600 ~/.age/sops-key.txt
    echo "✅ Age key pair generated at ~/.age/sops-key.txt"
else
    echo "✅ Age key pair already exists at ~/.age/sops-key.txt"
fi

# Step 4: Create .sops.yaml config for K8s 1.37 manifests
echo "⚙️ Creating .sops.yaml configuration..."
cat > .sops.yaml << EOF
# SOPS 3.8 configuration for Kubernetes 1.37 manifests
creation_rules:
  # Encrypt all K8s Secret manifests
  - path_regex: ".*\.(yaml|yml)$"
    encrypted_regex: "^(data|stringData)$"
    age:
      - "$(grep -oP 'public key: \K.*' ~/.age/sops-key.txt)"
    # K8s 1.37 specific: add kubectl annotation for native decryption
    annotations:
      kubectl.kubernetes.io/decryption-provider: "sops"
      kubectl.kubernetes.io/decryption-version: "3.8.0"
EOF

echo "✅ .sops.yaml created. Add this file to your Git repo root."
echo "🔒 Next step: Encrypt your first K8s secret with 'sops -e k8s-secret.yaml > k8s-secret.enc.yaml'"

#!/usr/bin/env python3
# validate-sops-secrets.py - Validate SOPS-encrypted K8s 1.37 manifests in Git pre-commit hooks
# Requires: Python 3.10+, sops 3.8+, pyyaml, kubernetes-client
import sys
import os
import subprocess
import re
import yaml
from typing import List, Dict, Optional

# Configuration
SOPS_MIN_VERSION = "3.8.0"
K8S_MANIFEST_REGEX = re.compile(r".*\.(yaml|yml)$") 
PLAINTEXT_SECRET_REGEX = re.compile(r"^\s+(data|stringData):\s*$")
SOPS_ENCRYPTED_MARKER = "sops:"

def check_sops_version() -> bool:
    """Verify SOPS version meets minimum requirement"""
    try:
        result = subprocess.run(
            ["sops", "--version"],
            capture_output=True,
            text=True,
            check=True
        )
        version = result.stdout.strip().split(" ")[0]
        return version >= SOPS_MIN_VERSION
    except (subprocess.CalledProcessError, FileNotFoundError):
        return False

def get_staged_k8s_manifests() -> List[str]:
    """Get list of staged K8s manifest files from Git"""
    try:
        result = subprocess.run(
            ["git", "diff", "--cached", "--name-only", "--diff-filter=ACM"],
            capture_output=True,
            text=True,
            check=True
        )
        files = result.stdout.strip().split("\n")
        return [f for f in files if K8S_MANIFEST_REGEX.match(f) and os.path.exists(f)]
    except subprocess.CalledProcessError:
        print("❌ Failed to get staged Git files. Are you in a Git repo?")
        sys.exit(1)

def validate_manifest(file_path: str) -> Optional[str]:
    """Validate a single K8s manifest for SOPS encryption compliance"""
    try:
        with open(file_path, "r") as f:
            content = f.read()
            # Check if file is SOPS encrypted
            if SOPS_ENCRYPTED_MARKER not in content:
                # Check if it's a Secret manifest with plaintext data
                if "kind: Secret" in content:
                    for line in content.split("\n"):
                        if PLAINTEXT_SECRET_REGEX.match(line):
                            return f"Plaintext Secret data found in {file_path}"
            else:
                # Verify SOPS can decrypt the file (valid encryption)
                try:
                    subprocess.run(
                        ["sops", "-d", file_path],
                        capture_output=True,
                        check=True
                    )
                except subprocess.CalledProcessError:
                    return f"Invalid SOPS encryption in {file_path}"
        return None
    except Exception as e:
        return f"Error reading {file_path}: {str(e)}"

def main() -> int:
    """Main entry point for pre-commit validation"""
    if not check_sops_version():
        print(f"❌ SOPS version must be >= {SOPS_MIN_VERSION}. Install from {SOPS_GITHUB_REPO}")
        return 1

    print("🔍 Validating staged K8s manifests for SOPS compliance...")
    staged_files = get_staged_k8s_manifests()
    if not staged_files:
        print("✅ No K8s manifests staged for commit.")
        return 0

    errors = []
    for file in staged_files:
        error = validate_manifest(file)
        if error:
            errors.append(error)

    if errors:
        print("❌ Validation failed:")
        for err in errors:
            print(f"  - {err}")
        print("\nFix by running: sops -e  > .enc.yaml && git add .enc.yaml")
        return 1
    else:
        print(f"✅ All {len(staged_files)} staged manifests are SOPS compliant.")
        return 0

if __name__ == "__main__":
    sys.exit(main())

package main

// sops-k8s-deploy.go - Decrypt SOPS-encrypted K8s 1.37 secrets and apply to cluster
// Requires: Go 1.22+, sops 3.8+, kubectl 1.37+, k8s.io/client-go
import (
    "bytes"
    "context"
    "encoding/json"
    "fmt"
    "os"
    "os/exec"
    "path/filepath"
    "time"

    metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
    "k8s.io/client-go/kubernetes"
    "k8s.io/client-go/tools/clientcmd"
)

const (
    sopsMinVersion = "3.8.0"
    k8sManifestDir = "./k8s-manifests"
)

// checkSOPSVersion verifies SOPS meets minimum version
func checkSOPSVersion() error {
    cmd := exec.Command("sops", "--version")
    out, err := cmd.Output()
    if err != nil {
        return fmt.Errorf("sops not found: %w", err)
    }
    version := string(out[:len(out)-1]) // trim newline
    if version < sopsMinVersion {
        return fmt.Errorf("sops version %s < minimum %s", version, sopsMinVersion)
    }
    return nil
}

// decryptManifest decrypts a SOPS-encrypted manifest using sops CLI
func decryptManifest(path string) ([]byte, error) {
    cmd := exec.Command("sops", "-d", path)
    out, err := cmd.Output()
    if err != nil {
        return nil, fmt.Errorf("failed to decrypt %s: %w", path, err)
    }
    return out, nil
}

// applyManifest applies a decrypted K8s manifest to the cluster
func applyManifest(client *kubernetes.Clientset, manifest []byte) error {
    // Use kubectl apply for simplicity (supports all manifest types)
    cmd := exec.Command("kubectl", "apply", "-f", "-")
    cmd.Stdin = bytes.NewReader(manifest)
    out, err := cmd.Output()
    if err != nil {
        return fmt.Errorf("failed to apply manifest: %w", err)
    }
    fmt.Printf("✅ Applied manifest: %s\n", string(out))
    return nil
}

// main entry point
func main() {
    // Verify SOPS version
    if err := checkSOPSVersion(); err != nil {
        fmt.Printf("❌ SOPS check failed: %v\n", err)
        os.Exit(1)
    }

    // Load k8s config
    config, err := clientcmd.BuildConfigFromFlags("", filepath.Join(os.Getenv("HOME"), ".kube", "config"))
    if err != nil {
        fmt.Printf("❌ Failed to load k8s config: %v\n", err)
        os.Exit(1)
    }
    client, err := kubernetes.NewForConfig(config)
    if err != nil {
        fmt.Printf("❌ Failed to create k8s client: %v\n", err)
        os.Exit(1)
    }

    // List all encrypted manifests in directory
    err = filepath.Walk(k8sManifestDir, func(path string, info os.FileInfo, err error) error {
        if err != nil {
            return err
        }
        if info.IsDir() || filepath.Ext(path) != ".enc.yaml" {
            return nil
        }
        fmt.Printf("🔓 Decrypting %s...\n", path)
        decrypted, err := decryptManifest(path)
        if err != nil {
            return fmt.Errorf("decryption failed: %w", err)
        }
        fmt.Printf("🚀 Applying %s to K8s 1.37 cluster...\n", path)
        if err := applyManifest(client, decrypted); err != nil {
            return fmt.Errorf("apply failed: %w", err)
        }
        return nil
    })

    if err != nil {
        fmt.Printf("❌ Deployment failed: %v\n", err)
        os.Exit(1)
    }
    fmt.Println("✅ All SOPS-encrypted manifests deployed successfully to K8s 1.37 cluster.")
}

# Generate individual age keys for 3 team members + CI runner
age-keygen -o alice-age-key.txt
age-keygen -o bob-age-key.txt
age-keygen -o ci-runner-age-key.txt

# Extract public keys and add to .sops.yaml
echo "age:" >> .sops.yaml
grep "public key: " alice-age-key.txt | awk '{print "  - " $3}' >> .sops.yaml
grep "public key: " bob-age-key.txt | awk '{print "  - " $3}' >> .sops.yaml
grep "public key: " ci-runner-age-key.txt | awk '{print "  - " $3}' >> .sops.yaml

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/getsops/sops
    rev: v3.8.0
    hooks:
      - id: sops-validate
        args: ["--k8s-manifests"]
  - repo: local
    hooks:
      - id: validate-sops-secrets
        name: Validate SOPS K8s Secrets
        entry: python3 validate-sops-secrets.py
        language: system
        files: \.(yaml|yml)$

# Configure kubectl to use SOPS decryption provider
kubectl config set-credentials sops-user --decryption-provider=sops --decryption-version=3.8.0

# Apply encrypted manifest directly (no manual decryption needed)
kubectl apply -f k8s-manifests/base/encrypted-secret.enc.yaml

k8s-sops-encryption/
├── .sops.yaml
├── .pre-commit-config.yaml
├── validate-sops-secrets.py
├── sops-setup.sh
├── k8s-manifests/
│   ├── base/
│   │   ├── namespace.yaml
│   │   └── encrypted-secret.enc.yaml
│   └── overlays/
│       ├── production/
│       │   └── encrypted-secret.enc.yaml
│       └── staging/
│           └── encrypted-secret.enc.yaml
├── .github/
│   └── workflows/
│       └── deploy-sops-secrets.yaml
└── README.md