# SOPS Configuration for secrets encryption
# Public keys are safe to commit; private keys stay in cluster

creation_rules:
  # Encrypt secrets, configs, and sensitive files
  # Multiple public keys for key rotation support
  # Files matching these patterns will be encrypted automatically with `sops -e`
  - path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
    age:
      - age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
      - age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
    encrypted_regex: '^data|^stringData'  # Only encrypt data fields, keep structure readable

  # Fallback rule for .enc.yaml files
  - path_regex: '.*\.enc\.ya?ml'
    age:
      - age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
      - age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
    encrypted_regex: '^data|^stringData'

# To encrypt a file locally:
#   sops --encrypt k8s/configmap.yaml > k8s/configmap.yaml
#
# To decrypt and view:
#   sops k8s/configmap.yaml
#
# To decrypt to stdout:
#   sops --decrypt k8s/configmap.yaml
#
# The private age keys are stored in the cluster at:
#   kubectl -n argocd get secret sops-age -o jsonpath='{.data.key\.txt}' | base64 -d
#
# Key rotation: Multiple public keys can coexist for decryption
# Only private keys MUST be kept secret (in cluster only)