.sops.yaml

---
creation_rules:
  - path_regex: cluster/.*\.sops\.ya?ml
    encrypted_regex: "^(data|stringData)$"
    key_groups:
      - age:
          - age1ms2d7n4yhaq0mdap4cfyaq2xtfutlachqapkjfr0z2qr7ghc2ckq000jhm
  - path_regex: cluster/.*\.sops\.toml
    key_groups:
      - age:
          - age1ms2d7n4yhaq0mdap4cfyaq2xtfutlachqapkjfr0z2qr7ghc2ckq000jhm
  - path_regex: ansible/.*\.sops\.ya?ml
    unencrypted_regex: "^(kind)$"
    key_groups:
      - age:
          - age1ms2d7n4yhaq0mdap4cfyaq2xtfutlachqapkjfr0z2qr7ghc2ckq000jhm
  - path_regex: kubernetes/.*\.sops\.ya?ml
    encrypted_regex: "^(data|stringData|fromCIDR|clusterDomain|k8sServiceHost|cidrs)$"
    key_groups:
      - age:
          - age1ms2d7n4yhaq0mdap4cfyaq2xtfutlachqapkjfr0z2qr7ghc2ckq000jhm
  - path_regex: machineconfigs/.*.yaml
    encrypted_regex: "^(crt|certSANs|dnsDomain|endpoint|secret|bootstraptoken|clusterName|hostname|secretboxEncryptionSecret|token|key|password|addresses|gateway|id)$"
    key_groups:
      - age:
          - age1ms2d7n4yhaq0mdap4cfyaq2xtfutlachqapkjfr0z2qr7ghc2ckq000jhm
  - path_regex: secrets.yaml
    encrypted_regex: "^(secret|bootstraptoken|secretboxencryptionsecret|token|key)$"
    key_groups:
      - age:
          - age1ms2d7n4yhaq0mdap4cfyaq2xtfutlachqapkjfr0z2qr7ghc2ckq000jhm
  - path_regex: kubeconfig
    encrypted_regex: "^client-key-data$"
    key_groups:
      - age:
          - age1ms2d7n4yhaq0mdap4cfyaq2xtfutlachqapkjfr0z2qr7ghc2ckq000jhm
  - path_regex: talosconfig
    encrypted_regex: "^key$"
    key_groups:
      - age:
          - age1ms2d7n4yhaq0mdap4cfyaq2xtfutlachqapkjfr0z2qr7ghc2ckq000jhm
  - path_regex: ^kubernetes\/.*\/gotk-components[^\/]*\.ya?ml$
    encrypted_regex: "^(args)$"
    key_groups:
      - age:
          - age1ms2d7n4yhaq0mdap4cfyaq2xtfutlachqapkjfr0z2qr7ghc2ckq000jhm