# Tells the `sops` CLI which recipient to encrypt for, and which files that
# applies to. Files matching path_regex below get encrypted for this age
# public key when you run `sops -e`. Only the public key lives here — it can
# encrypt, but cannot decrypt anything. The matching private key lives only
# on your machine (~/.config/sops/age/keys.txt) and inside the cluster (a
# Secret created by hand, never committed) — see docs/10-secrets.md.
#
# Convention: any file ending in .sops.yaml is a secret meant to be committed
# encrypted. Plain .yaml files are never treated as secrets by this rule, so
# an accidental `sops -e` on the wrong file won't silently do nothing useful.
#
# encrypted_regex scopes encryption to only the actual secret payload
# fields (data/stringData), leaving apiVersion, kind, and metadata (name,
# namespace, labels) in plain text. Without this, sops would also encrypt
# metadata.name/namespace into ciphertext strings containing characters
# Kubernetes object names can't legally contain, and the SopsSecret would
# fail to apply at all. sops-secrets-operator decrypts into a *separate*
# new Secret rather than mutating this object in place, so this scoping is
# the standard, safe pattern for it (unlike some other GitOps decrypt tools).
creation_rules:
  - path_regex: .*\.sops\.yaml$
    encrypted_regex: ^(data|stringData)$
    age: age1udejf5qa66rd6yvj5r8dz0fjnqfh0quf4t339c3cpqr26mkx2ydq3zel07