SOPS evaluation: rotate keys and recover before relying on it

Encrypting a secrets file is only one part of managing secrets. SOPS supports structured encrypted files and several key backends. The decisive questions are who can decrypt, how access is revoked, and whether deployment still works after a key change.

Create a disposable YAML secret with multiple authorized recipients. Edit one field, review the Git diff, and confirm values remain encrypted. Revoke one recipient, rotate the data key, and verify the former key cannot decrypt new material. Run a staging deployment and inspect logs and temporary files for plaintext leaks. The SOPS project documents supported formats and key providers.

Back up the keys separately from encrypted files and rehearse recovery with a different operator. Compare alternatives on access audit, emergency rotation, CI integration, and blast radius. Never publish a real secret merely to test a workflow.