diff --git a/infra/secrets/.gitignore b/infra/secrets/.gitignore
new file mode 100644
index 0000000..3bff447
--- /dev/null
+++ b/infra/secrets/.gitignore
@@ -0,0 +1 @@
+tigris-csi.yaml
diff --git a/infra/secrets/tigris-csi.sops.yaml b/infra/secrets/tigris-csi.sops.yaml
new file mode 100644
index 0000000..bd92e4f
--- /dev/null
+++ b/infra/secrets/tigris-csi.sops.yaml
@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: csi-tigris-secret
+    namespace: kube-system
+type: Opaque
+data:
+    accessKeyID: ENC[AES256_GCM,data:ASV2JRdWnMVXNlaZ8M5quPvGybz82n1B3FwTkdgq5TGWPC93ztNc7Uvkr66a7gY1hK1sbk0siaQSy78lQ2ZgfcS7icxlK8+F,iv:lvzIfe/ZzBhTPf2l0R4+5NEFH6JCv39ekIoi1MFPuh0=,tag:a4tTEXhiepnne+ziJjXieg==,type:str]
+    secretAccessKey: ENC[AES256_GCM,data:WOEwR0DJ0Ww3CWJ/967RNKwgjLxs16cT+rFqfwuGTg+AsJDtsfRjWmbQCjDSxXfrE2SLwAspZjBb4AHKH8fFlz/ZgvvnQw36RlHu7rHBFjj5g0A6xk4T1Bq/aC5uKOVbyG+ZQA==,iv:3eRXFR2UMNgHR++eQlaIvj8UdyyaLv2rqCVz5FS0gXE=,tag:TrgeO0J3kaPokr37k9JVBw==,type:str]
+    endpoint: ENC[AES256_GCM,data:Z9enllk3jqfe2WjrC6h5pJLGW3tqEwLaOpO5bXjA0Jk=,iv:wURV81n4dC4I9A++C79FGBtslGJuIjMUT0JjDNcAk/w=,tag:iMi7BSCvcHF+dEad5weKSg==,type:str]
+    region: ENC[AES256_GCM,data:okhKwEj6gGY=,iv:ySGmuuk1N8nJx85Fzcn0qoZf9m5Xp7RDT/wmmvLVpH8=,tag:n9KzCTWs/axSLxgfxKmf9A==,type:str]
+sops:
+    age:
+        - recipient: age1r0tjhg6uexyj0p7fp0ftv5h7r7e3ptzkk2797pznfvrvsm576u0s37yyaw
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxQ3haQkdJOHhoQmlsazMy
+            WGpMa3JzYkxnbG5ybm9JUVEzK1g0bTh5UXdjCmpCSmdoV1FMcE1ZSDRHTllrRGMr
+            Mk9qUXpjTVovaEQ2L1VkdVpvQWZlL3cKLS0tIFF3b1FVSEdUWGtudFpQMGEzYzk1
+            VVNtdTU2TDBqS2dBM25yKzdpam9QWGcKq4Lg8qqT3F3mrNFKhm6nXuMtqqveF8Zj
+            3Aj0i9eRXRufPuS0uC+BAgdIigodB6atouN0J8SefAZregZrIkSjCw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-05-30T14:09:04Z"
+    mac: ENC[AES256_GCM,data:QwUvVBwH2RIVVClr/g60L2M8d9hkINyXJ2CJHeywdNCdv+eMcdSjlpagsMZAF01U8887SGgVlQ7uiIVb0GurMmcEHB9TOPwuetPxzNLm/dN75M/FBpoWV/2Rhj0p6e9mUXQbt3kKbTwDJ7A4QNZmfKRNdx8L5SnlEHiIsYaQb68=,iv:a9wnE0e/hXt0w52jgN77ESqCnnpY3EQ4XnzRB0k1tvU=,tag:+bqdBLbhUULDvTjoZCdAZA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.10.2