Skip to main content

Data Flow: Secrets

Purpose: For platform engineers, explains how secrets flow from encrypted YAML in Git to usable Kubernetes Secrets in the cluster.

Flow Summary​

Components​

ComponentNamespaceRole
SOPS (CLI)Developer workstationEncrypts secret values before commit
Age key pairflux-system (private), Git (public)Asymmetric encryption — public key encrypts, private key decrypts
Kustomize Controllerflux-systemDecrypts SOPS-encrypted files during reconciliation

Sequence​

  1. Developer encrypts a Secret manifest using sops --encrypt with the cluster's Age public key.
  2. Encrypted file is committed and pushed to Git (only data/stringData values are encrypted; metadata remains readable).
  3. Source Controller fetches the updated repository.
  4. Kustomize Controller encounters the encrypted file during Kustomization build.
  5. Controller decrypts values in-memory using the Age private key stored in the sops-age Secret in flux-system.
  6. Decrypted manifest is applied to the target namespace as a standard Kubernetes Secret.
  7. Pods reference the Secret via envFrom, secretKeyRef, or volume mounts.

Security Properties​

  • Private key never leaves the cluster (injected at bootstrap, stored as a Kubernetes Secret).
  • Git history contains only ciphertext — safe for version control.
  • Rotation: re-encrypt all secrets with a new Age key, update the cluster secret, reconcile.
  • SOPS supports multiple recipients: one key per cluster, one for break-glass recovery.