.sops.yaml

# SOPS configuration: who can decrypt the Secrets in deploy/flux/
# (docs/architecture/ci-release.md, "SaaS 的祕密怎麼進叢集"; deploy/flux/README.md).
#
# - One rule per cluster under deploy/flux/clusters/: only Kubernetes Secrets named *.sops.yaml
#   in that cluster's directory are encrypted, and only their data and stringData values: names
#   and keys stay readable in a PR, values do not. A cluster's key never decrypts another
#   cluster's files.
# - Recipients are age public keys: the cluster's key (its private key is the Secret sops-age in
#   flux-system, never in git) and one key per operator (each private key stays on that person's
#   device). Add or remove a recipient, then run `sops updatekeys -y` on every file of that
#   cluster (docs/runbooks/secrets.md); `bun test deploy/flux` fails while a file is encrypted for
#   other recipients than its rule names.
# - Until a rule's recipients are filled in, sops refuses to encrypt for it ("empty key group"),
#   so no Secret can be committed with a key that nobody holds.
# - Each recipient is one line with its role, and only its role, in a comment, never a person's
#   or a machine's name:
#       - age1... # cluster: demo
#       - age1... # operator
#   `bun test deploy/flux` (scripts/flux/lib.ts, sopsRecipientProblems) checks that a rule is
#   empty or holds its own cluster's key or keys plus every operator key, and no other cluster's
#   key.
creation_rules:
  # The SaaS cluster (MS4).
  - path_regex: (^|/)deploy/flux/clusters/saas/[^/]+(/[^/]+)*\.sops\.yaml$
    encrypted_regex: ^(data|stringData)$
    age: []
  # The demo environment (Laysi/trustiot-v2#457, deploy/flux/README.md 「展示叢集」): the demo
  # cluster's key, generated on the demo machine, and the operators' keys.
  - path_regex: (^|/)deploy/flux/clusters/demo/[^/]+(/[^/]+)*\.sops\.yaml$
    encrypted_regex: ^(data|stringData)$
    age:
      - age17tmfvm966vuuu82a5jn6zw6uhcjaqhstxl5xajlcw7e0a7gfy4ws84hytc # cluster: demo
      - age1nsq9mcnwfhg2vra3hjw6tp9dfhy8lq2366hjr2l96fcq07yvq46q8nnrsk # operator