# Secret fixtures for disallow-plaintext-secrets (R-SEC-01).
# The "good" secret is shaped like a SOPS-encrypted manifest: values are ENC[...]
# ciphertext and a top-level `sops` block (with a mac) is present. The "bad" secret
# is plaintext with no `sops` block. NOTE: the ENC[...] strings below are fixtures,
# not real ciphertext -- no plaintext secret material is present (docs/07 rule).
apiVersion: v1
kind: Secret
metadata:
  name: good-secret-sops
  namespace: app-ns
type: Opaque
data:
  password: ENC[AES256_GCM,data:Zm9vYmFy,iv:AAAA,tag:BBBB,type:str]
sops:
  mac: ENC[AES256_GCM,data:CCCC,iv:DDDD,tag:EEEE,type:str]
  version: 3.8.1
---
apiVersion: v1
kind: Secret
metadata:
  name: bad-secret-plain
  namespace: app-ns
type: Opaque
stringData:
  password: hunter2-this-would-be-plaintext