.sops.yaml

---
creation_rules:
    # Select all files ending in .sops.yaml but not files whose entire name is
    # .sops.yaml also look for files with secrets in the name and ending in
    # .yaml or .json (e.g. secrets.yaml, secrets.json, my-secrets.yaml,
    # encrypted.sops.json, etc.) and apply the following rules to them.
    - path_regex: ^(.*/)?.*(secrets|.*\.sops)\.(ya?ml|json)$
      ##
      ## NOTE: use of encrypted_regex and unencrypted_regex are mutually
      ## exclusive. You can only use one or the other.
      ##
      ## encrypted_regex
      # Select only files containing data and stringData fields
      # encrypted_regex: ^(data|stringData)$
      # Select all fields (not recommended!!!)
      # encrypted_regex: .*
      ## unencrypted_regex (recommended method)
      # Do not encrypt the following header fields:
      unencrypted_regex: ^(apiVersion|kind|metadata|type)$
      ## AGE Public Key (recipient)
      age: age1uh4xmxfre8wsglm3zmz765crc5y8qc42nklgfq8hlrhglunqyguqdcac6h