jakman85andClaude Opus 4.8
bb2e9fc931
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
26 lines
800 B
YAML
26 lines
800 B
YAML
# Secret fixtures for disallow-plaintext-secrets (R-SEC-01).
|
|
# The "good" secret is shaped like a SOPS-encrypted manifest: values are ENC[...]
|
|
# ciphertext and a top-level `sops` block (with a mac) is present. The "bad" secret
|
|
# is plaintext with no `sops` block. NOTE: the ENC[...] strings below are fixtures,
|
|
# not real ciphertext -- no plaintext secret material is present (docs/07 rule).
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: good-secret-sops
|
|
namespace: app-ns
|
|
type: Opaque
|
|
data:
|
|
password: ENC[AES256_GCM,data:Zm9vYmFy,iv:AAAA,tag:BBBB,type:str]
|
|
sops:
|
|
mac: ENC[AES256_GCM,data:CCCC,iv:DDDD,tag:EEEE,type:str]
|
|
version: 3.8.1
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: bad-secret-plain
|
|
namespace: app-ns
|
|
type: Opaque
|
|
stringData:
|
|
password: hunter2-this-would-be-plaintext
|