Fix .sops.yaml to scope encryption to secret payload fields only

2026-09-03 04:31:03 +01:00
parent 0a733a7d76
commit 7e9406dff0
2 changed files with 19 additions and 5 deletions
@@ -8,6 +8,16 @@
 # Convention: any file ending in .sops.yaml is a secret meant to be committed
 # encrypted. Plain .yaml files are never treated as secrets by this rule, so
 # an accidental `sops -e` on the wrong file won't silently do nothing useful.
+#
+# encrypted_regex scopes encryption to only the actual secret payload
+# fields (data/stringData), leaving apiVersion, kind, and metadata (name,
+# namespace, labels) in plain text. Without this, sops would also encrypt
+# metadata.name/namespace into ciphertext strings containing characters
+# Kubernetes object names can't legally contain, and the SopsSecret would
+# fail to apply at all. sops-secrets-operator decrypts into a *separate*
+# new Secret rather than mutating this object in place, so this scoping is
+# the standard, safe pattern for it (unlike some other GitOps decrypt tools).
 creation_rules:
  - path_regex: .*\.sops\.yaml$
+    encrypted_regex: ^(data|stringData)$
    age: age1udejf5qa66rd6yvj5r8dz0fjnqfh0quf4t339c3cpqr26mkx2ydq3zel07