14 lines
804 B
YAML
14 lines
804 B
YAML
|
# Tells the `sops` CLI which recipient to encrypt for, and which files that
|
||
|
|
# applies to. Files matching path_regex below get encrypted for this age
|
||
|
|
# public key when you run `sops -e`. Only the public key lives here — it can
|
||
|
|
# encrypt, but cannot decrypt anything. The matching private key lives only
|
||
|
|
# on your machine (~/.config/sops/age/keys.txt) and inside the cluster (a
|
||
|
|
# Secret created by hand, never committed) — see docs/10-secrets.md.
|
||
|
|
#
|
||
|
|
# Convention: any file ending in .sops.yaml is a secret meant to be committed
|
||
|
|
# encrypted. Plain .yaml files are never treated as secrets by this rule, so
|
||
|
|
# an accidental `sops -e` on the wrong file won't silently do nothing useful.
|
||
|
|
creation_rules:
|
||
|
|
- path_regex: .*\.sops\.yaml$
|
||
|
|
age: age1udejf5qa66rd6yvj5r8dz0fjnqfh0quf4t339c3cpqr26mkx2ydq3zel07
|