Not every secret needs a Vault server.

A GitOps repo needs its Secret manifests to actually be safe to commit — Mozilla SOPS encrypts the values in place, so the file can live in git without becoming another leak.

secrets.yaml, encrypted

data:
  DB_PASSWORD: ENC[AES256_GCM,data:Xk3f...]
# keys stay readable — a reviewer sees WHAT
# changed in a diff, never the actual value

Vault vs. SOPS — not either/or

Vault: dynamic, auto-expiring credentials, real infra to run, centralized live audit.

SOPS + age: zero infrastructure, secrets version alongside the manifests that use them — the right default for a small team's GitOps repo.

SOPS doesn't remove the need to protect a key somewhere — it concentrates that protection into one place (an age key) instead of leaving the real value spread across every clone of the repo.