Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings
Discussion options

sops encrypts more than I have configured in the .sops.yaml file.

I have the following k8s helm values configuration:

---
clusterCollector:
  ingress:
    enabled: true
    className: "traefik"
    annotations:
      traefik.ingress.kubernetes.io/router.entrypoints: websecure
      traefik.ingress.kubernetes.io/router.tls: "true"
      traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect@kubernetescrd
    hosts:
      - host: fqdn.example.com
        paths:
          - path: /
            pathType: Prefix
    tls:
      - secretName: wildcard-cloudflare-production-01
        hosts:
          -  fqdn.example.com

my .sops.yaml file

creation_rules:
  - path_regex: .*.yaml
    encrypted_regex: "^(data|stringData|email|dnsNames|hosts?)$"
    age: age1....

Expected result:

---
clusterCollector:
  ingress:
    enabled: true
    className: "traefik"
    annotations:
      traefik.ingress.kubernetes.io/router.entrypoints: websecure
      traefik.ingress.kubernetes.io/router.tls: "true"
      traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect@kubernetescrd
    hosts:
      - host: ENC[AES256_GCM,data:Xxnj6+pRnwYcl83W+9ZbyP2OYmG+IAOdKj9acZqKQgAbs1GiFNjXJD3/,iv:D97v8RPTFzub8/jQGRIRHAB149P0PkikeY/V1D3OiaY=,tag:Fjq0730CuFhX0fquQgY4yw==,type:str]
        paths:
          - path: /
            pathType: Prefix
    tls:
      - secretName: wildcard-cloudflare-production-01
        hosts:
          -  ENC[AES256_GCM,data:VFzF4sfRpuBVtgSqP/dusutwsDCJcGJeqgRIIcSNl3AO4OVtMDV5/zJO,iv:W+TzRYVt4dHiDxjCmixhXdvnRT28RxtYiAK9xJzWEz8=,tag:XtgjVev+m8rmqBz5R3GyfQ==,type:str]

Actual result:

clusterCollector:
    ingress:
        enabled: true
        className: traefik
        annotations:
            traefik.ingress.kubernetes.io/router.entrypoints: websecure
            traefik.ingress.kubernetes.io/router.tls: "true"
            traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect@kubernetescrd
        hosts:
            - host: ENC[AES256_GCM,data:Xxnj6+pRnwYcl83W+9ZbyP2OYmG+IAOdKj9acZqKQgAbs1GiFNjXJD3/,iv:D97v8RPTFzub8/jQGRIRHAB149P0PkikeY/V1D3OiaY=,tag:Fjq0730CuFhX0fquQgY4yw==,type:str]
              paths:
                - path: ENC[AES256_GCM,data:/Q==,iv:vtlNgvBhv1fMZiFg8EuZzTbP7Htu89+bk45YE9psBts=,tag:a8D5wdDY/6OkhDs1RoxoJw==,type:str]
                  pathType: ENC[AES256_GCM,data:0sw6Ignl,iv:j1OGgyu5vneqKaKBxUwztA4QgsBA6fLpfHZN0pQvhbY=,tag:XQqVlc4zLR2RltEhl8JqxQ==,type:str]
        tls:
            - secretName: wildcard-cloudflare-production-01
              hosts:
                - ENC[AES256_GCM,data:VFzF4sfRpuBVtgSqP/dusutwsDCJcGJeqgRIIcSNl3AO4OVtMDV5/zJO,iv:W+TzRYVt4dHiDxjCmixhXdvnRT28RxtYiAK9xJzWEz8=,tag:XtgjVev+m8rmqBz5R3GyfQ==,type:str]

Why is it also encrypting path and pathType?

You must be logged in to vote

I think I understand. Because it's matching first "hosts", it encrypts everything beneath.

Replies: 1 comment · 1 reply

Comment options

I think I understand. Because it's matching first "hosts", it encrypts everything beneath.

You must be logged in to vote
1 reply
@devstein
Comment options

@Madic- Hey again 😄 yes that's correct

Answer selected by devstein
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
🙏
Q&A
Labels
None yet
2 participants
Morty Proxy This is a proxified and sanitized view of the page, visit original site.