.sops.yaml

---
# creation rules are evaluated sequentially, the first match wins
creation_rules:
  # Match ansible host and group vars
  - path_regex: ansible/(host|group)_vars/.*\.ya?ml
    age: 'age1ety65vhtrhlevgmm899eyvdmv4avfm0replxg5tz6a2jyq84n4us7ryfc6'

  # Match ansible files
  - path_regex: ansible/roles/.*/files/.*
    age: 'age1ety65vhtrhlevgmm899eyvdmv4avfm0replxg5tz6a2jyq84n4us7ryfc6'

  # Match terraform files
  - path_regex: terraform/.*/locals.tf
    age: 'age1ety65vhtrhlevgmm899eyvdmv4avfm0replxg5tz6a2jyq84n4us7ryfc6'
  - path_regex: terraform/.*/*.yaml
    age: 'age1ety65vhtrhlevgmm899eyvdmv4avfm0replxg5tz6a2jyq84n4us7ryfc6'

  # Match kubernetes ssl certificates
  - path_regex: pki/*
    age: 'age1ety65vhtrhlevgmm899eyvdmv4avfm0replxg5tz6a2jyq84n4us7ryfc6'
  - path_regex: ansible/roles/.*/files/etc/kubernetes/.*.conf
    age: 'age1ety65vhtrhlevgmm899eyvdmv4avfm0replxg5tz6a2jyq84n4us7ryfc6'
  - path_regex: ansible/roles/.*/files/etc/kubernetes/pki/.*.(crt|key|pub)
    age: 'age1ety65vhtrhlevgmm899eyvdmv4avfm0replxg5tz6a2jyq84n4us7ryfc6'
  - path_regex: ansible/roles/.*/files/etc/kubernetes/pki/etcd/.*.(crt|key)
    age: 'age1ety65vhtrhlevgmm899eyvdmv4avfm0replxg5tz6a2jyq84n4us7ryfc6'
  - path_regex: ansible/roles/.*/files/etc/kubernetes/secrets/.*.(ya?ml)
    age: 'age1ety65vhtrhlevgmm899eyvdmv4avfm0replxg5tz6a2jyq84n4us7ryfc6'