# How does Flux decrypt Secrets that are stored encrypted with SOPS in Git?

Flux CD, Medium (Advanced), Security. https://k8wiz.com/uquiz/how-does-flux-decrypt-secrets-that-are-stored-encrypted-with-sops-in-git

- A. source-controller decrypts the files while it clones the repository
- B. A mutating webhook decrypts each Secret when it is created
- C. The age private key is committed to the repository next to the encrypted files
- D. The Kustomization sets spec.decryption to sops with a Secret holding the key

**Answer:** The Kustomization sets spec.decryption to sops with a Secret holding the key

**Explanation:** kustomize-controller decrypts SOPS files at build time with keys from the Secret in spec.decryption.secretRef, such as an entry ending in .agekey for age, or with cloud KMS credentials. The files stay encrypted in Git and in the source artifact.