Fix .sops.yaml to scope encryption to secret payload fields only

.sops.yaml

@@ -8,6 +8,16 @@
 # Convention: any file ending in .sops.yaml is a secret meant to be committed
 # encrypted. Plain .yaml files are never treated as secrets by this rule, so
 # an accidental `sops -e` on the wrong file won't silently do nothing useful.
+#
+# encrypted_regex scopes encryption to only the actual secret payload
+# fields (data/stringData), leaving apiVersion, kind, and metadata (name,
+# namespace, labels) in plain text. Without this, sops would also encrypt
+# metadata.name/namespace into ciphertext strings containing characters
+# Kubernetes object names can't legally contain, and the SopsSecret would
+# fail to apply at all. sops-secrets-operator decrypts into a *separate*
+# new Secret rather than mutating this object in place, so this scoping is
+# the standard, safe pattern for it (unlike some other GitOps decrypt tools).
 creation_rules:
   - path_regex: .*\.sops\.yaml$
+    encrypted_regex: ^(data|stringData)$
     age: age1udejf5qa66rd6yvj5r8dz0fjnqfh0quf4t339c3cpqr26mkx2ydq3zel07

docs/10-secrets.md

@@ -87,11 +87,15 @@ and it must happen before this file is ever `git add`ed:
 sops --encrypt --in-place apps/cert-manager/cloudflare-api-token.sops.yaml
 ```
 
-`sops` reads `.sops.yaml`, sees the filename ends in `.sops.yaml`, and
-encrypts every value under `stringData` for your age public key. Open the
-file afterward — the keys (`api-token`) stay readable, the values are now
-unintelligible ciphertext with `sops` metadata appended. That's what's safe
-to commit.
+`sops` reads `.sops.yaml`, sees the filename ends in `.sops.yaml`, and —
+because of that file's `encrypted_regex: ^(data|stringData)$` — encrypts
+only the values under `stringData`, for your age public key. `apiVersion`,
+`kind`, and everything under `metadata` (name, namespace) stay in plain
+text on purpose: Kubernetes object names have to be plain DNS-safe
+strings, and encrypting them would produce a `SopsSecret` that fails to
+apply at all. Open the file afterward — `stringData`'s values are now
+unintelligible ciphertext with `sops` metadata appended; everything else is
+still readable. That's what's safe to commit.
 
 Once pushed and synced, the operator finds this `SopsSecret`, decrypts it
 using the private key mounted from step 2, and creates an ordinary