riotpiao-poimen/homelab-frontend
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

security: rotate SOPS age key - update to new public key only
CI / CI (push) Successful in 5m25s
Details

Browse Source 
The old age key was compromised during terminal output exposure.
This commit rotates to a new age key pair:
- Old public key: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla (RETIRED)
- New public key: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
- Private key: Stored securely in sops-age secret (argocd namespace)

.sops.yaml now uses the new public key for all future encryptions.
Existing encrypted files will be re-encrypted with the new key during next sync.

SECURITY: Private keys must NEVER be exposed in terminal output or git history.
This commit is contained in:
Admin Bot
2026-09-13 11:00:14 +09:00
parent b8f95506ca
commit 4a00312906
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.sops.yaml
+2 -2
View File
@@ -6,12 +6,12 @@ creation_rules:
# Public AGE key - safe to share and commit # Public AGE key - safe to share and commit
# Files matching these patterns will be encrypted automatically with `sops -e` # Files matching these patterns will be encrypted automatically with `sops -e`
- path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml) - path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
age: ***REMOVED*** age: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
encrypted_regex: '^data|^stringData' # Only encrypt data fields, keep structure readable encrypted_regex: '^data|^stringData' # Only encrypt data fields, keep structure readable
# Fallback rule for .enc.yaml files # Fallback rule for .enc.yaml files
- path_regex: '.*\.enc\.ya?ml' - path_regex: '.*\.enc\.ya?ml'
age: ***REMOVED*** age: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
encrypted_regex: '^data|^stringData' encrypted_regex: '^data|^stringData'
# To encrypt a file locally: # To encrypt a file locally: