Flux CD
Medium
Security
How does Flux decrypt Secrets that are stored encrypted with SOPS in Git?
Select your answer:
Show answer and explanation
Answer: The Kustomization sets spec.decryption to sops with a Secret holding the key
Explanation
kustomize-controller decrypts SOPS files at build time with keys from the Secret in spec.decryption.secretRef, such as an entry ending in .agekey for age, or with cloud KMS credentials. The files stay encrypted in Git and in the source artifact.
More medium Flux CD questions
- What does the --no-cross-namespace-refs=true flag on the Flux controllers do?
- How can a Kustomization apply resources with a tenant's limited permissions instead of kustomize-controller's own?
- What does 'flux diff kustomization my-app --path ./apps/my-app' show?
- How can a HelmRelease take its Helm values from a ConfigMap or Secret?
- Which HelmRelease setting makes helm-controller retry a failed first install?
- What does driftDetection.mode: enabled do on a HelmRelease?