# Values for the upstream sops-secrets-operator chart, nested under
# `sops-secrets-operator:` (the dependency's name in Chart.yaml).
#
# The operator needs the age *private* key to decrypt SopsSecret resources.
# That key must never be committed — it's mounted from a Secret you create
# by hand, once, directly on the cluster (see docs/10-secrets.md), the same
# kind of one-time manual bootstrap step as Argo CD's own install.
sops-secrets-operator:
  secretsAsFiles:
    - name: sops-age-key-file
      mountPath: /etc/sops-age-key-file
      secretName: sops-age-key-file
  extraEnv:
    - name: SOPS_AGE_KEY_FILE
      value: /etc/sops-age-key-file/key