From 4a00312906ba725f3968187656fde2663b1763ab Mon Sep 17 00:00:00 2001 From: Admin Bot Date: Sun, 13 Sep 2026 11:00:14 +0900 Subject: [PATCH] security: rotate SOPS age key - update to new public key only The old age key was compromised during terminal output exposure. This commit rotates to a new age key pair: - Old public key: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla (RETIRED) - New public key: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp - Private key: Stored securely in sops-age secret (argocd namespace) .sops.yaml now uses the new public key for all future encryptions. Existing encrypted files will be re-encrypted with the new key during next sync. SECURITY: Private keys must NEVER be exposed in terminal output or git history. --- .sops.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.sops.yaml b/.sops.yaml index 7cd3f1e..636ab0b 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -6,12 +6,12 @@ creation_rules: # Public AGE key - safe to share and commit # Files matching these patterns will be encrypted automatically with `sops -e` - path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml) - age: ***REMOVED*** + age: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp encrypted_regex: '^data|^stringData' # Only encrypt data fields, keep structure readable # Fallback rule for .enc.yaml files - path_regex: '.*\.enc\.ya?ml' - age: ***REMOVED*** + age: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp encrypted_regex: '^data|^stringData' # To encrypt a file locally: