Managing Secrets privately with sops-nix

Fri, 15 May 2026 02:37:41 +0200

Motivation ¶

I run a small Kubernetes cluster managed declaratively with Talos Linux and kubenix. The repository that defines the cluster – every Helm deployment, Talos node configuration and ArgoCD application – is something I’d like to publish: it’s how I document my own setup to help myself remember what’s true. Other people might find the patterns useful.

The cluster also has secrets: a kubeconfig, a Hetzner Cloud API token, a talosconfig with a CA bundle inside it. Those obviously can’t go in the public repo. But without them, the infrastructure as code is incomplete.

Secrets on Simon Shine

Managing Secrets privately with sops-nix

Motivation ¶