42cb7ac5bf
- Add test-key (age1wtzdf8...) for shared test environment - Enable mac_only_encrypted: true in .sops.yaml (SOPS >= 3.9.0) Allows adding new YAML fields without decryption key - Re-encrypt all 10 files with mac_only_encrypted metadata - Strict isolation: dev-key ↔ *.dev.enc.yaml, prod-key ↔ *.prod.enc.yaml - test-key can only decrypt *.test.enc.yaml (not dev/prod) - Add dev/verify-sops-isolation.sh — 33-point verification script - Keep dev/prod files with admin+dev / admin+prod only (no test-key) Verified: 33/33 isolation checks passed Co-authored-by: XoR <xor@benadis.ru>
29 lines
2.1 KiB
YAML
29 lines
2.1 KiB
YAML
# Kargo secrets for dev/test cluster
|
|
passwordHash: ENC[AES256_GCM,data:Brg8qSTsGeft72w0FhnmKu0CgfL14zDLLIifyFdS+MJDtWhhRJq88Wh2OOrjylTsteYJeb9LaGh7T/6I,iv:PapmZ9/fubkIMz4Br4W4Xqj8UB6BJl5708V0nPRqgxw=,tag:r1iCfDxwmNRJT56dnEEo2Q==,type:str]
|
|
tokenSigningKey: ENC[AES256_GCM,data:f1i9nVF74bWcGl0GXBujwo215aXV4pAm9r3AX181nUq32QyWdkzR0+7e+4EfqoZkpOorCKZQq6pJEn45th9YJw==,iv:yMT3dnlNnblyUJdmWb9XFQlnPnLIT12iw6aNxN94lY0=,tag:WE6/dL8+382eYMj/tYq/+w==,type:str]
|
|
sops:
|
|
age:
|
|
- recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVVEhRZkhINm80MGYzcGZP
|
|
a1ZURk9GYVRiT1plV0U1WlQvenFieU1TbGt3CnlqbExOZGpEMEd2MDlDV0k1Z0ZI
|
|
UzJxK1ByVkhrNXlJWkhCUHhTSzl0cW8KLS0tIDRKb0dmNXhXSnIzMEhnOUNjMVRD
|
|
V1oySnBJeFdyWGdGYzhpN2JIRG00cUEKta06XCymUR8ltBL/6egR/IHTaS/Q0vih
|
|
ep4kyfexVOK+OAnbvA/4BSUBKXAr2L+GN3tAuG4YOnehX764WTaoxQ==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
- recipient: age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4VHQvczM3MDhEcXJGQkpa
|
|
Vm1LYURwbUk5MEhXOVBLdFl5UWRLcmZpaWwwCmdrMGFmNlZVL2pQdDFFR1BrZ25h
|
|
ZEZMazJsR3hhZlNsUTNSNEVEUlNtcE0KLS0tIEplZnk2eDNXd2ZOcVhJNThieWJU
|
|
UkZSc1E1dHVieFRMSDNhSXN0ZC9OdGsK+7GeHMVOYmhIpt1tZTo/l3JdTQL1ZuC7
|
|
ZLydtSlmPfT4rkUmtyfEMf8HU45V9KO7IUSWyWBOy7XU1whb7frdHw==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-03-12T14:08:13Z"
|
|
mac: ENC[AES256_GCM,data:DWPS9s6QGbeFKEsZGBqKZE596Bqm1nY5D3JrBnEkRVwQhXo4oo6QIwSOpojBx4cSANANzi+CkhCGXIIAhKxXLn4Aii9y/d1Lpe6S7umFeLg/15Qb7CAC6mI/WPK6H71zD8VSxzHictDek9opfdhIzrlr9xIvKRwzyhsF7I76kgE=,iv:Epf8fh8kMDpFpV0BOVV542n8OitoDcy7yRg0gI76aFU=,tag:Yd4oFywmeALME220szSWzA==,type:str]
|
|
encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
|
|
mac_only_encrypted: true
|
|
version: 3.12.1
|