(refactor): cleanup ro + rw secrets files from repo and added necessary ci secrets files (.ci.admin.secrets.yaml -> sops-master + .ci.secrets.yaml -> sops-ro, both must be approved by @Patina-Network/infra)#25
Conversation
This stack of pull requests is managed by Graphite. Learn more about stacking. |
…ry ci secrets files (.ci.admin.secrets.yaml -> sops-master + .ci.secrets.yaml -> sops-ro, both must be approved by @Patina-Network/infra)
tahminator
force-pushed
the
06-09-_refactor_cleanup_ro_rw_secrets_files_from_repo_and_added_necessary_ci_secrets_files_.ci.admin.secrets.yaml_-_sops-master_.ci.secrets.yaml_-_sops-ro_both_must_be_approved_by_patina-network_infra_
branch
from
69a7a48 to
8c1f769
Compare
Graphite Automations"Request reviewers once CI passes" took an action on this PR • (06/10/26)2 reviewers were added to this PR based on Henry Chen's automation. |
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
|
| - path_regex: ci.secrets.yaml | ||
| azure_keyvault: "https://sops-ro.vault.azure.net/keys/sops-ro-key/" | ||
| - path_regex: .*secret(s)?.*\.yaml | ||
| azure_keyvault: "https://sops-master.vault.azure.net/keys/sops-key/" |
There was a problem hiding this comment.
Configuration mismatch: The path_regex rules will cause encryption key conflicts.
The file secrets.ci.yaml matches the second rule .*secret(s)?.*\.yaml which specifies the master vault (sops-master.vault.azure.net), but the actual file is encrypted with the ro vault (sops-ro.vault.azure.net/keys/sops-ro-key).
This will cause SOPS operations to fail when trying to edit or re-encrypt secrets.ci.yaml because SOPS will attempt to use the wrong key.
Fix: Update the first rule to match the actual filename pattern:
creation_rules:
- path_regex: (ci|.*\.ci)\.secrets\.yaml
azure_keyvault: "https://sops-ro.vault.azure.net/keys/sops-ro-key/"
- path_regex: .*secret(s)?.*\.yaml
azure_keyvault: "https://sops-master.vault.azure.net/keys/sops-key/"Or alternatively, ensure secrets.ci.yaml is re-encrypted with the master vault to match the current regex pattern.
| - path_regex: ci.secrets.yaml | |
| azure_keyvault: "https://sops-ro.vault.azure.net/keys/sops-ro-key/" | |
| - path_regex: .*secret(s)?.*\.yaml | |
| azure_keyvault: "https://sops-master.vault.azure.net/keys/sops-key/" | |
| - path_regex: (ci|.*\.ci)\.secrets\.yaml | |
| azure_keyvault: "https://sops-ro.vault.azure.net/keys/sops-ro-key/" | |
| - path_regex: .*secret(s)?.*\.yaml | |
| azure_keyvault: "https://sops-master.vault.azure.net/keys/sops-key/" | |
Spotted by Graphite
Is this helpful? React 👍 or 👎 to let us know.
1 participant
No description provided.