SOPS and AGE: Practical Secrets Management in GitOps

Secrets encrypted in Git, per-environment keys, Flux automatic decryption. Our actual implementation: kubeconfig files in project root, SOPS .enc.yaml files, age keys in GitHub secrets.