Admin Bot
4341b1109b
CI / CI (push) Successful in 4m46s
Keep both public keys in .sops.yaml: - Old key: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla (existing cluster secrets are encrypted with this) - New key: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp (new secrets will be encrypted with this) Private keys remain secure in cluster (sops-age secret). Public key history cleaned from git (see prior commits).
35 lines
1.3 KiB
YAML
35 lines
1.3 KiB
YAML
# SOPS Configuration for secrets encryption
|
|
# Public keys are safe to commit; private keys stay in cluster
|
|
|
|
creation_rules:
|
|
# Encrypt secrets, configs, and sensitive files
|
|
# Multiple public keys for key rotation support
|
|
# Files matching these patterns will be encrypted automatically with `sops -e`
|
|
- path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
|
|
age:
|
|
- age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
|
|
- age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
|
|
encrypted_regex: '^data|^stringData' # Only encrypt data fields, keep structure readable
|
|
|
|
# Fallback rule for .enc.yaml files
|
|
- path_regex: '.*\.enc\.ya?ml'
|
|
age:
|
|
- age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
|
|
- age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
|
|
encrypted_regex: '^data|^stringData'
|
|
|
|
# To encrypt a file locally:
|
|
# sops --encrypt k8s/configmap.yaml > k8s/configmap.yaml
|
|
#
|
|
# To decrypt and view:
|
|
# sops k8s/configmap.yaml
|
|
#
|
|
# To decrypt to stdout:
|
|
# sops --decrypt k8s/configmap.yaml
|
|
#
|
|
# The private age keys are stored in the cluster at:
|
|
# kubectl -n argocd get secret sops-age -o jsonpath='{.data.key\.txt}' | base64 -d
|
|
#
|
|
# Key rotation: Multiple public keys can coexist for decryption
|
|
# Only private keys MUST be kept secret (in cluster only)
|