ahmza.com/k8s-starter-pack
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix .sops.yaml to scope encryption to secret payload fields only

Browse Source
This commit is contained in:
ahmza
2026-09-03 04:31:03 +01:00
parent 0a733a7d76
commit 7e9406dff0
2 changed files with 19 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/10-secrets.md
+9 -5
View File
@@ -87,11 +87,15 @@ and it must happen before this file is ever `git add`ed:
sops --encrypt --in-place apps/cert-manager/cloudflare-api-token.sops.yaml
```
`sops` reads `.sops.yaml`, sees the filename ends in `.sops.yaml`, and
encrypts every value under `stringData` for your age public key. Open the
file afterward — the keys (`api-token`) stay readable, the values are now
unintelligible ciphertext with `sops` metadata appended. That's what's safe
to commit.
`sops` reads `.sops.yaml`, sees the filename ends in `.sops.yaml`, and —
because of that file's `encrypted_regex: ^(data|stringData)$` — encrypts
only the values under `stringData`, for your age public key. `apiVersion`,
`kind`, and everything under `metadata` (name, namespace) stay in plain
text on purpose: Kubernetes object names have to be plain DNS-safe
strings, and encrypting them would produce a `SopsSecret` that fails to
apply at all. Open the file afterward — `stringData`'s values are now
unintelligible ciphertext with `sops` metadata appended; everything else is
still readable. That's what's safe to commit.
Once pushed and synced, the operator finds this `SopsSecret`, decrypts it
using the private key mounted from step 2, and creates an ordinary