@egulatee/sops-secrets

@egulatee/sops-secrets

Load SOPS-encrypted secrets for use in Pulumi TypeScript projects.

Install

npm install @egulatee/sops-secrets

Usage

import { loadSecrets } from "@egulatee/sops-secrets";

// Decrypt any SOPS-encrypted file from kubernetes-architecture/secrets/
const s = loadSecrets("cloudflared");
s.cloudflare.account_id
s.cloudflare.zone_id
s.cloudflare.tunnel_token

// Kubeconfig follows the same pattern
const kubeconfig = loadSecrets("kubeconfig").kubeconfig;

Environment Variables

Variable	Required	Description
SOPS_SECRETS_DIR	CI only	Absolute path to secrets/ directory. Defaults to ../kubernetes-architecture/secrets relative to cwd.
SOPS_AGE_KEY	CI only	Age private key for decryption. Locally, SOPS reads ~/.config/sops/age/keys.txt automatically.

How it works

• loadSecrets(name) calls sops -d --output-type json secrets/<name>.enc.yaml
• Returns the parsed JSON object
• Plaintext values only exist in memory during pulumi up — never written to disk

Requirements

• sops must be installed and on PATH
• An Age key must be available (local keyfile or SOPS_AGE_KEY env var)