Lightweight GitOps Secrets: Replacing HashiCorp Vault with Mozilla SOPS and Age in FluxCD

HashiCorp Vault is an incredible enterprise tool, but running a high-availability Vault cluster (with Raft consensus, unsealing ceremonies, and backup rotations) requires significant operational overhead. For startups and engineering teams with under 50 developers, Vault is often massive overkill.

Mozilla SOPS combined with modern Age encryption keys allows you to store encrypted Kubernetes secrets directly in Git repositories safely, enabling pure GitOps workflows without the overhead of running a dedicated secret server.

Encrypting Secrets with Age and SOPS

# 1. Generate an Age keypair
age-keygen -o age.key
# Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p

# 2. Encrypt a Kubernetes Secret YAML file
sops --encrypt --age age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p --encrypted-regex '^(data|stringData)$' secret.yaml > secret.enc.yaml