From b8a70fc8076f17f24719fb15e11c24f0937609dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20Laguna?= Date: Thu, 22 Jan 2026 11:25:48 +0100 Subject: [PATCH] Update mozilla-sops.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Rubén Laguna --- content/en/flux/guides/mozilla-sops.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/content/en/flux/guides/mozilla-sops.md b/content/en/flux/guides/mozilla-sops.md index 9fec48950..1f43bb869 100644 --- a/content/en/flux/guides/mozilla-sops.md +++ b/content/en/flux/guides/mozilla-sops.md @@ -211,7 +211,20 @@ sops --age=age1helqcqsh9464r8chnwc2fzj8uv7vr5ntnsft0tn45v2xtz0hpfwq98cmsg \ --encrypt --encrypted-regex '^(data|stringData)$' --in-place basic-auth.yaml ``` -And finally set the decryption secret in the Flux Kustomization to `sops-age`. +Alternatively you can add a `.sops.yaml` file to avoid providing the `--age` and `--encrypted-regex` every time: + +```yaml +cat < ./clusters/cluster0/.sops.yaml +creation_rules: + - path_regex: .*.yaml + encrypted_regex: ^(data|stringData)$ + age: age1helqcqsh9464r8chnwc2fzj8uv7vr5ntnsft0tn45v2xtz0hpfwq98cmsg +EOF + +sops --encrypt --in-place basic-auth.yaml +``` + +And finally set the decryption secret in the Flux Kustomization to `sops-age`. i.e `flux create kustomization my-kustomization --source=GitRepository/my-repo --path="./kustomize/dev/" --prune=true --interval=1m --decryption-provider sops --decryption-secret sops-age --export` ## Encrypting secrets using HashiCorp Vault