Package: isops
IsOPS:IsOPerationsSecure__/\\\\\\\\\\\____________________/\\\\\_______/\\\\\\\\\\\\\_______/\\\\\\\\\\\___        
 _\/////\\\///___________________/\\\///\\\____\/\\\/////////\\\___/\\\/////////\\\_       
  _____\/\\\____________________/\\\/__\///\\\__\/\\\_______\/\\\__\//\\\______\///__      
   _____\/\\\______/\\\\\\\\\\__/\\\______\//\\\_\/\\\\\\\\\\\\\/____\////\\\_________     
    _____\/\\\_____\/\\\//////__\/\\\_______\/\\\_\/\\\/////////_________\////\\\______    
     _____\/\\\_____\/\\\\\\\\\\_\//\\\______/\\\__\/\\\_____________________\////\\\___   
      _____\/\\\_____\////////\\\__\///\\\__/\\\____\/\\\______________/\\\______\//\\\__  
       __/\\\\\\\\\\\__/\\\\\\\\\\____\///\\\\\/_____\/\\\_____________\///\\\\\\\\\\\/___ 
        _\///////////__\//////////_______\/////_______\///________________\///////////_____IsOPS (IsOPerationsSecure) is a minimal command line utility that helps you ensure that your secrets are encrypted correctly withsopsbefore committing them.isopswill read your configuration files, will scan all your secrets and alerts you if it finds any key that should be encrypted but it's not.InstallationYou can installisopsviapip:user@laptop:~$pipinstallisopsThe CLI is minimal:user@laptop:~$isopsUsage: isops [OPTIONS] PATHUtility to ensure all SOPS secrets are encrypterd.Options:-s, --summary            Print a summary at the end of the checks.-h, --help               Show this message and exit.-v, --version            Show the version and exit.-r, --config-regex TEXT  The regex that matches all the config files to use.[required]You must provide a directory to scan and a regex that matches all the sops configuration files.How it works?isopsis called with a directory and a regex. Then:It finds the config files using the provided regex.For each rule increation_rulesit finds the files according to thepath_regex.For each file found, it scans all the keys, no matter how nested the yaml is, in search for those keys that match theencrypted_regex.For each matched key, it checks if the associated value matches the sops regex"^ENC\[AES256_GCM,data:(.+),iv:(.+),tag:(.+),type:(.+)\]".If the config file doesn't provide apath_regexor aencrypted_regex, the default values are, respectively,".ya?ml$"and"".Usage exampleSuppose you have this situation:example
├── .sops.yaml
└── secret.yamlA.sops.yaml:creation_rules:-path_regex:(.*)?secret.yaml$encrypted_regex:"^(data|stringData)$"pgp:"FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4"and asecret.yaml:apiVersion:v1data:key:aGhkZDg4OGRoODRmaDQ4ZmJlbnNta21rbHdtc2k4kind:Secretmetadata:name:api-keytype:OpaqueIf you runisopsyou get a warning because your secret is not encrypted:user@laptop:~$isops./example--config-regex.sops.yamlFound config file: example/.sops.yamlexample/secret.yaml::key [UNSAFE]user@laptop:~$ echo $?1If the same secret is encrypted with sops:apiVersion:v1data:key:ENC[AES256_GCM,data:iCBh27Ort/dNVhP9D4y/AqI5d78U+2EHtHPX9u0/s9ANhA2VeqKSOQ==,iv:HkQVUgB6nvN3TU355K/PTU2NroahHAdoJhzJdgZFMwo=,tag:ayNppVmYJ/MLGrW9RtjV1A==,type:str]kind:Secretmetadata:name:api-keytype:Opaquesops:etc...thenisopswill give you the green light:user@laptop:~$isops./example--config-regex.sops.yamlFound config file: example/.sops.yamlexample/secret.yaml::key [SAFE]user@laptop:~$ echo $?0Another exampleYou can have a more complicated scenario where there are multiple sops configuration files, multiple environments and lots of secrets.Suppose you have this situation:example
├── .sops
│   ├── sops-dev.yaml
│   └── sops-prod.yaml
├── dev
│   ├── api-key-secret.yaml        <- Encrypted
│   ├── db-password-secret.yaml    <- Encrypted
│   ├── deployment.yaml
│   └── service.yaml
└── prod
    ├── api-key-secret.yaml        <- Not encrypted!
    ├── db-password-secret.yaml    <- Encrypted
    ├── deployment.yaml
    └── service.yamlThen if you runisopsyou get:user@laptop:~$isopsexample--config-regex"example/.sops/(.*).yaml$"Found config file: example/.sops/sops-dev.yamlFound config file: example/.sops/sops-prod.yamlexample/dev/db-password-secret.yaml::password [SAFE]example/dev/api-key-secret.yaml::key [SAFE]example/prod/db-password-secret.yaml::password [SAFE]example/prod/api-key-secret.yaml::key [UNSAFE]Sometimes the list of secret is very long: you can enable a small summary at the end with the--summaryoption:user@laptop:~$isopsexample--config-regex"example/.sops/(.*).yaml$"--summaryFound config file: example/.sops/sops-dev.yamlFound config file: example/.sops/sops-prod.yamlexample/dev/db-password-secret.yaml::password [SAFE]example/dev/api-key-secret.yaml::key [SAFE]example/prod/db-password-secret.yaml::password [SAFE]example/prod/api-key-secret.yaml::key [UNSAFE]---Summary:UNSAFE secret 'key' in 'example/prod/api-key-secret.yaml'3 safe 1 unsafeThe previous example can be found in theexampledirectory. The sample application was generated byChatGPTwith the prompt: "Please, generate an example Kubernetes application with two secrets".Pre-commit hookisopscan be also used as apre-commithook. For example:repos:-repo:https://github.com/lorenzophys/isopsrev:v0.2.0hooks:-id:isopsargs:---config-regex=.sops/(.*).ya?ml$---summaryLicenseThis project is licensed under theMIT License- see theLICENSEfile for details.