From 4341b1109bf8423e576b6ef7e626e27862c299b3 Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Sun, 13 Sep 2026 11:10:34 +0900
Subject: [PATCH] security: restore old public key in .sops.yaml for cluster
 decryption

Keep both public keys in .sops.yaml:
- Old key: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
  (existing cluster secrets are encrypted with this)
- New key: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
  (new secrets will be encrypted with this)

Private keys remain secure in cluster (sops-age secret).
Public key history cleaned from git (see prior commits).
---
 .sops.yaml                         | 17 ++++++++++++-----
 k8s/configmap.yaml                 |  2 +-
 k8s/gateway-config-secret.enc.yaml |  2 +-
 3 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/.sops.yaml b/.sops.yaml
index 636ab0b..184e9e3 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,17 +1,21 @@
 # SOPS Configuration for secrets encryption
-# Public key is safe to commit; private key stays in cluster
+# Public keys are safe to commit; private keys stay in cluster
 
 creation_rules:
   # Encrypt secrets, configs, and sensitive files
-  # Public AGE key - safe to share and commit
+  # Multiple public keys for key rotation support
   # Files matching these patterns will be encrypted automatically with `sops -e`
   - path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
-    age: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
+    age:
+      - age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+      - age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
     encrypted_regex: '^data|^stringData'  # Only encrypt data fields, keep structure readable
 
   # Fallback rule for .enc.yaml files
   - path_regex: '.*\.enc\.ya?ml'
-    age: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
+    age:
+      - age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+      - age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
     encrypted_regex: '^data|^stringData'
 
 # To encrypt a file locally:
@@ -23,5 +27,8 @@ creation_rules:
 # To decrypt to stdout:
 #   sops --decrypt k8s/configmap.yaml
 #
-# The private age key is stored in the cluster at:
+# The private age keys are stored in the cluster at:
 #   kubectl -n argocd get secret sops-age -o jsonpath='{.data.key\.txt}' | base64 -d
+#
+# Key rotation: Multiple public keys can coexist for decryption
+# Only private keys MUST be kept secret (in cluster only)
diff --git a/k8s/configmap.yaml b/k8s/configmap.yaml
index 297e94a..635630e 100644
--- a/k8s/configmap.yaml
+++ b/k8s/configmap.yaml
@@ -17,7 +17,7 @@ sops:
             SXB2b2wrZlVCeUhXaG5QQkxWQXJ6aDgKqV2V1jyeKQHr1iDaWR36WZWZdkZeSUcw
             BcA8vT73qdIb3Rnt6zYIBfgFYuVgQp4m+2pU3J4xgyGKPwQEtLz2XA==
             -----END AGE ENCRYPTED FILE-----
-          recipient: ***REMOVED***
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
     encrypted_regex: ^data
     lastmodified: "2026-09-12T23:58:01Z"
     mac: ENC[AES256_GCM,data:4zterh5GOq6fibw+npmmIB//+7nYoKoQDXoinNCbTEAiQPuxqcpYJn1Mxmt37ZobG8Y7rqQYEpoRLCangFZA2b7mbkEWeEf9qXhP+cufqWB+Aagr7b8XmbL6tNSRxamxr+4WyjJzSrY+5w6d/4usDGRJhs+AB2F/Vmq7peDhZiU=,iv:G+ZbPJ7YiQlrhwt+7EUxWq8pNelw/bUz6thYufh3+rA=,tag:uaCoQ7wg7Rg9xKkq5ZT6NA==,type:str]
diff --git a/k8s/gateway-config-secret.enc.yaml b/k8s/gateway-config-secret.enc.yaml
index 6869fa1..29e515e 100644
--- a/k8s/gateway-config-secret.enc.yaml
+++ b/k8s/gateway-config-secret.enc.yaml
@@ -18,7 +18,7 @@ sops:
             TVYvcTFHVEMwdk8wb2lZbzBMcWdMOEUKrbjTZ7AeuNqfyWolsYGh0Dc5bE2bDU+y
             vXI+gz8GwN+VNR06G39uE8wAIvlCL9rJocWx9uNcCChZGCaaJu3GPQ==
             -----END AGE ENCRYPTED FILE-----
-          recipient: ***REMOVED***
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
     encrypted_regex: ^data|^stringData
     lastmodified: "2026-09-13T01:04:23Z"
     mac: ENC[AES256_GCM,data:LN3J+B0QonolFEeisj+NwYjp6F196uIcDyxf4ZoLdAs67Pmpi2YBtB0J4BEbUirR9N13M5k9gWjtDJwgHONYBCjEGC4sCQS3JvNkvwiTf7uSCKaY5+Qq71VtUljf9c9P+Ni/D+zGEVTWHFYtirnsnGpxb/YNYDvbxLFRRI+sLKg=,iv:HQP/SeN+6spVpLRIrYsyBVpbji7YC1oK3lCPmmB0OK0=,tag:e+yfBwzPXSqvBMU4Wn/Tfg==,type:str]