The Truth About secrets management with SOPS and Falco: Results

package main

import (
    "fmt",
    "os",
    "path/filepath",

    "github.com/getsops/sops/v3/age",
    "github.com/getsops/sops/v3/cmd/sops/formats",
    "github.com/getsops/sops/v3/decrypt",
    "github.com/getsops/sops/v3/encrypt",
    "github.com/getsops/sops/v3/keys",
    "github.com/getsops/sops/v3/stores",
)

// SOPSSecretManager handles encryption/decryption of secrets using SOPS with Age keys
type SOPSSecretManager struct {
    ageKeyPath string // Path to Age private key for decryption
    pubKey     string // Age public key for encryption
}

// NewSOPSSecretManager initializes a new manager, validates key paths
func NewSOPSSecretManager(ageKeyPath, pubKey string) (*SOPSSecretManager, error) {
    // Validate private key exists if provided
    if ageKeyPath != "" {
        if _, err := os.Stat(ageKeyPath); os.IsNotExist(err) {
            return nil, fmt.Errorf("age private key not found at %s: %w", ageKeyPath, err)
        }
    }
    if pubKey == "" {
        return nil, fmt.Errorf("public key cannot be empty for encryption")
    }
    return &SOPSSecretManager{
        ageKeyPath: ageKeyPath,
        pubKey:     pubKey,
    }, nil
}

// EncryptSecret takes a plaintext secret and returns SOPS-encrypted output
func (s *SOPSSecretManager) EncryptSecret(plaintext []byte, outputPath string) error {
    // Create Age key group from public key
    keyGroup, err := age.MasterKeyFromRecipient(s.pubKey)
    if err != nil {
        return fmt.Errorf("failed to parse Age public key: %w", err)
    }

    // Configure encryption options: use Age, JSON format for portability
    opts := encrypt.Options{
        KeyGroups: []keys.KeyGroup{keyGroup},
        Format:    formats.JsonFormat,
        // Enable integrity checks to detect tampering
        EnableMac: true,
    }

    // Encrypt the plaintext
    encrypted, err := encrypt.Encrypt(plaintext, opts)
    if err != nil {
        return fmt.Errorf("encryption failed: %w", err)
    }

    // Write to output path with restricted permissions (0600)
    if err := os.WriteFile(outputPath, encrypted, 0600); err != nil {
        return fmt.Errorf("failed to write encrypted secret to %s: %w", outputPath, err)
    }

    fmt.Printf("Successfully encrypted secret to %s\n", outputPath)
    return nil
}

// DecryptSecret reads a SOPS-encrypted file and returns plaintext
func (s *SOPSSecretManager) DecryptSecret(inputPath string) ([]byte, error) {
    // Read encrypted file
    encryptedData, err := os.ReadFile(inputPath)
    if err != nil {
        return nil, fmt.Errorf("failed to read encrypted file %s: %w", inputPath, err)
    }

    // Load Age private key if path is set
    var decryptKey keys.MasterKey
    if s.ageKeyPath != "" {
        keyData, err := os.ReadFile(s.ageKeyPath)
        if err != nil {
            return nil, fmt.Errorf("failed to read Age private key: %w", err)
        }
        decryptKey, err = age.MasterKeyFromRecipient(string(keyData))
        if err != nil {
            return nil, fmt.Errorf("failed to parse Age private key: %w", err)
        }
    } else {
        // Fall back to default Age key in ~/.config/sops/age/keys.txt
        defaultKeyPath := filepath.Join(os.Getenv("HOME"), ".config", "sops", "age", "keys.txt")
        keyData, err := os.ReadFile(defaultKeyPath)
        if err != nil {
            return nil, fmt.Errorf("no age key provided and default key not found at %s: %w", defaultKeyPath, err)
        }
        decryptKey, err = age.MasterKeyFromRecipient(string(keyData))
        if err != nil {
            return nil, fmt.Errorf("failed to parse default Age key: %w", err)
        }
    }

    // Decrypt with SOPS, auto-detect format
    plaintext, err := decrypt.Decrypt(encryptedData, decryptKey, formats.FormatForPath(inputPath))
    if err != nil {
        return nil, fmt.Errorf("decryption failed (invalid key or tampered data): %w", err)
    }

    return plaintext, nil
}

func main() {
    // Example usage: encrypt a database secret
    manager, err := NewSOPSSecretManager(
        os.Getenv("SOPS_AGE_KEY_PATH"), // Set via env var
        os.Getenv("SOPS_AGE_PUB_KEY"),  // Age public key from env
    )
    if err != nil {
        fmt.Fprintf(os.Stderr, "Initialization failed: %v\n", err)
        os.Exit(1)
    }

    // Encrypt a sample secret
    plaintextSecret := []byte("{\"db_user\":\"admin\",\"db_pass\":\"sup3r_s3cur3_p@ss\",\"db_host\":\"10.0.1.5\"}")
    if err := manager.EncryptSecret(plaintextSecret, "encrypted_db_secret.json"); err != nil {
        fmt.Fprintf(os.Stderr, "Encryption failed: %v\n", err)
        os.Exit(1)
    }

    // Decrypt the same secret
    decrypted, err := manager.DecryptSecret("encrypted_db_secret.json")
    if err != nil {
        fmt.Fprintf(os.Stderr, "Decryption failed: %v\n", err)
        os.Exit(1)
    }
    fmt.Printf("Decrypted secret: %s\n", decrypted)
}

package main

import (
    "context",
    "fmt",
    "os",
    "path/filepath",
    "time",

    "github.com/falcosecurity/client-go/pkg/api/events",
    "github.com/falcosecurity/client-go/pkg/client",
    "github.com/falcosecurity/client-go/pkg/client/options",
)

// FalcoSecretDetector connects to a running Falco instance to detect unauthorized secret access
type FalcoSecretDetector struct {
    falcoClient *client.Client
    // Rules for matching secret access events: map of process names to secret path patterns
    secretRules map[string][]string
}

// NewFalcoSecretDetector initializes a detector connected to Falco via Unix socket
func NewFalcoSecretDetector(socketPath string, secretRules map[string][]string) (*FalcoSecretDetector, error) {
    if socketPath == "" {
        socketPath = "/var/run/falco/falco.sock" // Default Falco socket path
    }
    if secretRules == nil {
        return nil, fmt.Errorf("secret rules map cannot be nil")
    }

    // Connect to Falco gRPC socket
    c, err := client.NewClient(
        options.WithSocketPath(socketPath),
        options.WithTimeout(5*time.Second),
    )
    if err != nil {
        return nil, fmt.Errorf("failed to connect to Falco at %s: %w", socketPath, err)
    }

    return &FalcoSecretDetector{
        falcoClient: c,
        secretRules: secretRules,
    }, nil
}

// StartListening subscribes to Falco events and triggers alerts on secret access violations
func (f *FalcoSecretDetector) StartListening(ctx context.Context) error {
    // Subscribe to all Falco events
    eventStream, err := f.falcoClient.Subscribe(ctx, &events.SubscribeRequest{})
    if err != nil {
        return fmt.Errorf("failed to subscribe to Falco events: %w", err)
    }
    defer eventStream.Close()

    fmt.Println("Listening for Falco events... Press Ctrl+C to stop.")

    // Process incoming events
    for {
        select {
        case <-ctx.Done():
            fmt.Println("Context cancelled, stopping listener.")
            return nil
        default:
            // Receive next event
            event, err := eventStream.Recv()
            if err != nil {
                return fmt.Errorf("error receiving event: %w", err)
            }

            // Check if event matches secret access rules
            if f.isSecretAccessEvent(event) {
                f.triggerAlert(event)
            }
        }
    }
}

// isSecretAccessEvent checks if a Falco event matches configured secret access patterns
func (f *FalcoSecretDetector) isSecretAccessEvent(event *events.Event) bool {
    // Extract process name and file path from event (simplified for example)
    procName := event.GetFields()["proc.name"]
    filePath := event.GetFields()["fd.name"]

    // Check if process is in our rules
    allowedPaths, exists := f.secretRules[procName]
    if !exists {
        return false
    }

    // Check if accessed file matches any secret path patterns
    for _, pattern := range allowedPaths {
        if match, _ := filepath.Match(pattern, filePath); match {
            // If path is a secret pattern but process is not authorized, flag it
            return true
        }
    }
    return false
}

// triggerAlert logs and sends alerts for unauthorized secret access
func (f *FalcoSecretDetector) triggerAlert(event *events.Event) {
    fmt.Printf("🚨 UNAUTHORIZED SECRET ACCESS DETECTED 🚨\n")
    fmt.Printf("Time: %s\n", event.GetTime().AsTime().Format(time.RFC3339))
    fmt.Printf("Process: %s (PID: %s)\n", event.GetFields()["proc.name"], event.GetFields()["proc.pid"])
    fmt.Printf("Accessed File: %s\n", event.GetFields()["fd.name"])
    fmt.Printf("User: %s\n", event.GetFields()["user.name"])
    // In production, send to Slack/PagerDuty here
}

func main() {
    // Define rules: only allow kubectl and sops to access /secrets/* paths
    secretRules := map[string][]string{
        "kubectl": {"/secrets/*", "/etc/kubernetes/secrets/*"},
        "sops":    {"/secrets/*"},
    }

    // Initialize detector with default Falco socket
    detector, err := NewFalcoSecretDetector("", secretRules)
    if err != nil {
        fmt.Fprintf(os.Stderr, "Failed to initialize detector: %v\n", err)
        os.Exit(1)
    }

    // Start listening with cancellable context
    ctx, cancel := context.WithCancel(context.Background())
    defer cancel()

    // Handle Ctrl+C to cancel context
    go func() {
        time.Sleep(30 * time.Second) // Run for 30s for demo, replace with signal handling in prod
        cancel()
    }()

    if err := detector.StartListening(ctx); err != nil {
        fmt.Fprintf(os.Stderr, "Detector failed: %v\n", err)
        os.Exit(1)
    }
}

#!/bin/bash
set -euo pipefail  # Exit on error, undefined var, pipe failure
trap 'echo "Script failed at line $LINENO"; exit 1' ERR

# Configuration: adjust these variables for your project
SOPS_VERSION="v3.8.1"
FALCO_VERSION="0.37.1"
AGE_PUB_KEY="${SOPS_AGE_PUB_KEY:-}"  # Age public key from env
FALCO_SOCKET="${FALCO_SOCKET_PATH:-/var/run/falco/falco.sock}"
SECRETS_DIR="./secrets"  # Directory containing plaintext secrets to encrypt
ENCRYPTED_DIR="./encrypted-secrets"  # Output directory for SOPS-encrypted secrets
FALCO_RULES_FILE="./falco-secret-rules.yaml"  # Custom Falco rules for secret monitoring

# Validate required environment variables
if [[ -z "$AGE_PUB_KEY" ]]; then
    echo "ERROR: SOPS_AGE_PUB_KEY environment variable is not set."
    echo "Generate an Age key with: age-keygen -o ~/.config/sops/age/keys.txt"
    echo "Then set SOPS_AGE_PUB_KEY to the public key (starts with age1...)"
    exit 1
fi

# Install SOPS if not present
if ! command -v sops &> /dev/null; then
    echo "Installing SOPS ${SOPS_VERSION}..."
    curl -L "https://github.com/getsops/sops/releases/download/${SOPS_VERSION}/sops-${SOPS_VERSION}-linux-amd64" -o /usr/local/bin/sops
    chmod +x /usr/local/bin/sops
    echo "SOPS installed successfully."
fi

# Install Falco CLI if not present (for rule validation)
if ! command -v falco &> /dev/null; then
    echo "Installing Falco ${FALCO_VERSION} CLI..."
    curl -L "https://github.com/falcosecurity/falco/releases/download/${FALCO_VERSION}/falco-${FALCO_VERSION}-x86_64.tar.gz" -o /tmp/falco.tar.gz
    tar -xzf /tmp/falco.tar.gz -C /usr/local/bin --strip-components=1
    rm /tmp/falco.tar.gz
    echo "Falco CLI installed successfully."
fi

# Step 1: Encrypt all plaintext secrets in SECRETS_DIR with SOPS + Age
echo "Encrypting secrets in ${SECRETS_DIR}..."
mkdir -p "$ENCRYPTED_DIR"
for secret_file in "$SECRETS_DIR"/*; do
    if [[ -f "$secret_file" ]]; then
        filename=$(basename "$secret_file")
        encrypted_path="${ENCRYPTED_DIR}/${filename}.enc"

        echo "Encrypting $secret_file to $encrypted_path..."
        sops --age "$AGE_PUB_KEY" --encrypt "$secret_file" > "$encrypted_path"

        # Verify encryption worked by trying to decrypt (requires private key, skip in CI if not available)
        if [[ -n "${SOPS_AGE_KEY_PATH:-}" ]]; then
            echo "Verifying encryption for $filename..."
            sops --decrypt "$encrypted_path" > /dev/null
            echo "Verification passed for $filename."
        else
            echo "Skipping decryption verification (no SOPS_AGE_KEY_PATH set)."
        fi
    fi
done

# Step 2: Validate Falco rules for secret monitoring
echo "Validating Falco rules at ${FALCO_RULES_FILE}..."
if [[ ! -f "$FALCO_RULES_FILE" ]]; then
    echo "ERROR: Falco rules file not found at ${FALCO_RULES_FILE}"
    exit 1
fi
falco --validate "$FALCO_RULES_FILE"
echo "Falco rules validated successfully."

# Step 3: Run Falco in dry-run mode to check for existing secret access violations
echo "Running Falco dry-run check for secret access..."
if [[ -S "$FALCO_SOCKET" ]]; then
    falco --dry-run --socket "$FALCO_SOCKET" -r "$FALCO_RULES_FILE" --all-events 2>&1 | grep -i "secret" || echo "No secret access events found in dry run."
else
    echo "WARNING: Falco socket not found at ${FALCO_SOCKET}, skipping runtime check."
fi

# Step 4: Clean up temporary files
echo "Cleaning up..."
rm -rf /tmp/falco.tar.gz

echo "✅ CI secrets check completed successfully. Encrypted secrets are in ${ENCRYPTED_DIR}."

# Generate an Age key pair (store private key securely, e.g., in a hardware wallet)
age-keygen -o ~/.config/sops/age/keys.txt
# Print the public key to set as SOPS_AGE_PUB_KEY
age-keygen -y ~/.config/sops/age/keys.txt

# Custom Falco rule for auth service secret access
- rule: Unauthorized Auth Secret Access
  desc: Detect unauthorized access to production auth secrets
  condition: >
    fd.name startswith /secrets/prod/auth/ and
    not proc.name in (kubectl, auth-service, sops) and
    k8s.pod.labels.app=auth-service
  output: "Unauthorized access to auth secret (user=%user.name pod=%k8s.pod.name file=%fd.name)"
  priority: CRITICAL
  source: syscall

# Add SOPS decryption check to your GitHub Actions workflow
- name: Verify SOPS secrets
  run: |
    sops --decrypt ./encrypted-secrets/db-secret.json > /dev/null
    echo "Secrets are valid and decryptable."