ahmza.com/k8s-starter-pack
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix .sops.yaml to scope encryption to secret payload fields only

Browse Source
This commit is contained in:
ahmza
2026-09-03 04:31:03 +01:00
parent 0a733a7d76
commit 7e9406dff0
2 changed files with 19 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.sops.yaml
+10
View File
@@ -8,6 +8,16 @@
# Convention: any file ending in .sops.yaml is a secret meant to be committed # Convention: any file ending in .sops.yaml is a secret meant to be committed
# encrypted. Plain .yaml files are never treated as secrets by this rule, so # encrypted. Plain .yaml files are never treated as secrets by this rule, so
# an accidental `sops -e` on the wrong file won't silently do nothing useful. # an accidental `sops -e` on the wrong file won't silently do nothing useful.
#
# encrypted_regex scopes encryption to only the actual secret payload
# fields (data/stringData), leaving apiVersion, kind, and metadata (name,
# namespace, labels) in plain text. Without this, sops would also encrypt
# metadata.name/namespace into ciphertext strings containing characters
# Kubernetes object names can't legally contain, and the SopsSecret would
# fail to apply at all. sops-secrets-operator decrypts into a *separate*
# new Secret rather than mutating this object in place, so this scoping is
# the standard, safe pattern for it (unlike some other GitOps decrypt tools).
creation_rules: creation_rules:
- path_regex: .*\.sops\.yaml$ - path_regex: .*\.sops\.yaml$
encrypted_regex: ^(data|stringData)$
age: age1udejf5qa66rd6yvj5r8dz0fjnqfh0quf4t339c3cpqr26mkx2ydq3zel07 age: age1udejf5qa66rd6yvj5r8dz0fjnqfh0quf4t339c3cpqr26mkx2ydq3zel07
docs/10-secrets.md
+9 -5
View File
@@ -87,11 +87,15 @@ and it must happen before this file is ever `git add`ed:
sops --encrypt --in-place apps/cert-manager/cloudflare-api-token.sops.yaml sops --encrypt --in-place apps/cert-manager/cloudflare-api-token.sops.yaml
``` ```
`sops` reads `.sops.yaml`, sees the filename ends in `.sops.yaml`, and `sops` reads `.sops.yaml`, sees the filename ends in `.sops.yaml`, and —
encrypts every value under `stringData` for your age public key. Open the because of that file's `encrypted_regex: ^(data|stringData)$` — encrypts
file afterward — the keys (`api-token`) stay readable, the values are now only the values under `stringData`, for your age public key. `apiVersion`,
unintelligible ciphertext with `sops` metadata appended. That's what's safe `kind`, and everything under `metadata` (name, namespace) stay in plain
to commit. text on purpose: Kubernetes object names have to be plain DNS-safe
strings, and encrypting them would produce a `SopsSecret` that fails to
apply at all. Open the file afterward — `stringData`'s values are now
unintelligible ciphertext with `sops` metadata appended; everything else is
still readable. That's what's safe to commit.
Once pushed and synced, the operator finds this `SopsSecret`, decrypts it Once pushed and synced, the operator finds this `SopsSecret`, decrypts it
using the private key mounted from step 2, and creates an ordinary using the private key mounted from step 2, and creates an ordinary