jakman85andClaude Opus 4.8
f089adf261
Two dev.sh gaps surfaced while running bootstrap/sops/install-age-key.sh:
- kubectl defaulted to localhost:8080 (connection refused) because KUBECONFIG
was never set in the toolbox. Set KUBECONFIG=/work/infra/ansible/.cache/dev.kubeconfig
(override via DEV_KUBECONFIG); --network host already reaches 10.73.0.11:6443.
- age-keygen.sh writes the PRIVATE key to ~/.config/sops/age/keys.txt, but that
path was not mounted in the --rm container, so the key was lost on exit. Mount
${HOME}/.config/sops -> /root/.config/sops (created first) so the key persists
on the host and SOPS_AGE_KEY_FILE resolves to it.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
37 lines
2.3 KiB
YAML
37 lines
2.3 KiB
YAML
# .sops.yaml — SOPS creation rules for the platform repo (ADR-0007, R-SEC-01).
|
|
#
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# EFFECTIVE LOCATION: this file must live at the REPOSITORY ROOT to govern
|
|
# encryption of secrets under platform/** and apps/**. It is AUTHORED here in
|
|
# bootstrap/sops/ (the security engineer's subtree); the PM/clusters owner
|
|
# installs it at the repo root (copy or symlink). See bootstrap/sops/README.md
|
|
# "Interface / handoff". SOPS discovers .sops.yaml by walking UP from the file
|
|
# being encrypted to the repo root, so it only takes effect from root.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
#
|
|
# HOW ENCRYPTION WORKS HERE:
|
|
# - Only committed secrets are encrypted; plaintext never enters git.
|
|
# - `encrypted_regex` encrypts ONLY the value fields (data/stringData), leaving
|
|
# keys and structure in cleartext → readable, reviewable diffs (ADR-0007).
|
|
# - `age` recipient below is the PUBLIC key from age-keygen.sh. Filling it is a
|
|
# bootstrap step; the matching PRIVATE key is installed in-cluster as the
|
|
# `sops-age` Secret (age-key-secret.md) so Flux can decrypt at reconcile.
|
|
#
|
|
# TO ENCRYPT A SECRET (operator, not agents):
|
|
# sops --encrypt --in-place path/to/secret.sops.yaml
|
|
# # picks up the age recipient + rules below automatically.
|
|
|
|
creation_rules:
|
|
# Platform + app Secrets. Convention: encrypted files are named `*.sops.yaml`
|
|
# or live under a `secrets/` directory anywhere in the tree.
|
|
- path_regex: (^|/)(platform|apps|catalog)/.*(secret|sops)\.ya?ml$
|
|
encrypted_regex: "^(data|stringData)$"
|
|
# >>> REPLACE-ME <<< paste the age PUBLIC recipient printed by age-keygen.sh.
|
|
# Example shape (NOT a real key): age1qy...placeholder...0abcd
|
|
age: "age1u70g00m38pt4zte00n4fsqfyj3rf8725xn4w7e6lx80evt4rcalsdnprp8"
|
|
|
|
- path_regex: (^|/)secrets/.*\.ya?ml$
|
|
encrypted_regex: "^(data|stringData)$"
|
|
# >>> REPLACE-ME <<< same age PUBLIC recipient as above.
|
|
age: "age1u70g00m38pt4zte00n4fsqfyj3rf8725xn4w7e6lx80evt4rcalsdnprp8"
|