42cb7ac5bf
- Add test-key (age1wtzdf8...) for shared test environment - Enable mac_only_encrypted: true in .sops.yaml (SOPS >= 3.9.0) Allows adding new YAML fields without decryption key - Re-encrypt all 10 files with mac_only_encrypted metadata - Strict isolation: dev-key ↔ *.dev.enc.yaml, prod-key ↔ *.prod.enc.yaml - test-key can only decrypt *.test.enc.yaml (not dev/prod) - Add dev/verify-sops-isolation.sh — 33-point verification script - Keep dev/prod files with admin+dev / admin+prod only (no test-key) Verified: 33/33 isolation checks passed Co-authored-by: XoR <xor@benadis.ru>
38 lines
2.0 KiB
YAML
38 lines
2.0 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: github-creds
|
|
namespace: test-env
|
|
labels:
|
|
kargo.akuity.io/cred-type: git
|
|
type: Opaque
|
|
stringData:
|
|
repoURL: https://github.com/Kargones/deploy-app-kargo-private.git
|
|
username: Kargones
|
|
password: ENC[AES256_GCM,data:bni/9XNGoW9KwzL3ovyu/BDcdv5dgKo6vDoZUVSebueX60SJwnc+CA==,iv:ef3MR/6a6VRzanDMfl7H9PygSHV7HGqp0OkeY/Yv27Q=,tag:D4OWKTbj5HB+TURvJAEfbg==,type:str]
|
|
sops:
|
|
age:
|
|
- recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4TS92bXkwRGZaK0s4OHdE
|
|
Y25rMFRyK2FLeUJ1c0gwWlVQdm1OMDl5eUdrCmxQZ01vb2NwVXBoWXpJMzJ6VS9N
|
|
eTBKbjdQUmdIclFObmpqVW9qb2RUcWcKLS0tIDVjN2lTSWJ4ZVQwazZObThJRVhI
|
|
czJib0UzS0ZuOE9uaVpOclQ3cEI3cjQKnrqviLM7T5OEqhtT0rhSZ86vtr88gAtw
|
|
je4yt20hcATuKLKnjIorFtXR6tww1zW92LiORP2VTiYC25IuHv4ccA==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
- recipient: age16p0gwk8vt90vy2gm8jjca8rcyd2drv5526e997ukdelnv5ek8unqm0smuk
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlZDhDdVBQS3hsTDZVdi9G
|
|
dzk3SFpzT0NVdzhUcTB6bm16YlRhSjFNa1h3CllFR1hxdDNZc1JZMERtTlIxY1R3
|
|
dUtmRGlranY3eFFWTWU0VFVBMkRyREEKLS0tIEFNWG1wZG9SWkJCTGkxNUQwaU05
|
|
UFcwbGhuVXI0Q3d0VWpqM09KaWFGZkkKOfVRoQqOKWVPsvcnRrCLAUfvXZje2zrw
|
|
EQ5CeyjoZL9lxzuWMxoe71e1lzo1ecwV4Wdu4G54wSuzhxA9vwpSTg==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-03-12T14:08:14Z"
|
|
mac: ENC[AES256_GCM,data:mc59PsRuw1JnjMxFR/y37oOJmnoojpFd8hEKounvA/lMf1rBvUAcQ6sYK+qajBHvtnzlCuMpuetxYY1v2djfRrp4GhwQotmSpAb2fqO1kz1JEqHkFeZ2ZeBtnytVf9I95VAeU/zJV1X2TrUW14ZmOvowtdRYFkSdY6Z3/Hs9vic=,iv:DlsN9rmiEq/2xBQS/LghBoVQcT+7XfSJJ7r5rKhTB/k=,tag:cuLvv4e7r25mjVCGrQZYNA==,type:str]
|
|
encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
|
|
mac_only_encrypted: true
|
|
version: 3.12.1
|