24 lines
1.4 KiB
YAML
24 lines
1.4 KiB
YAML
# Tells the `sops` CLI which recipient to encrypt for, and which files that
|
|
# applies to. Files matching path_regex below get encrypted for this age
|
|
# public key when you run `sops -e`. Only the public key lives here — it can
|
|
# encrypt, but cannot decrypt anything. The matching private key lives only
|
|
# on your machine (~/.config/sops/age/keys.txt) and inside the cluster (a
|
|
# Secret created by hand, never committed) — see docs/10-secrets.md.
|
|
#
|
|
# Convention: any file ending in .sops.yaml is a secret meant to be committed
|
|
# encrypted. Plain .yaml files are never treated as secrets by this rule, so
|
|
# an accidental `sops -e` on the wrong file won't silently do nothing useful.
|
|
#
|
|
# encrypted_regex scopes encryption to only the actual secret payload
|
|
# fields (data/stringData), leaving apiVersion, kind, and metadata (name,
|
|
# namespace, labels) in plain text. Without this, sops would also encrypt
|
|
# metadata.name/namespace into ciphertext strings containing characters
|
|
# Kubernetes object names can't legally contain, and the SopsSecret would
|
|
# fail to apply at all. sops-secrets-operator decrypts into a *separate*
|
|
# new Secret rather than mutating this object in place, so this scoping is
|
|
# the standard, safe pattern for it (unlike some other GitOps decrypt tools).
|
|
creation_rules:
|
|
- path_regex: .*\.sops\.yaml$
|
|
encrypted_regex: ^(data|stringData)$
|
|
age: age1udejf5qa66rd6yvj5r8dz0fjnqfh0quf4t339c3cpqr26mkx2ydq3zel07
|