Documentation
¶
Overview ¶
Package sopsutil provides shared helpers for SOPS Age key resolution and secret building used by both the ArgoCD and Flux installers.
Index ¶
- Constants
- Variables
- func BuildSopsAgeSecret(namespace, ageKey string) *corev1.Secret
- func ExtractAgeKey(input string) string
- func ExtractAllAgeKeys(input string) []string
- func FilterKeysByPublicKeys(privateKeys, publicKeys []string) ([]string, error)
- func ResolveAgeKey(sops v1alpha1.SOPS) (string, error)
- func ResolveEnabledAgeKey(sops v1alpha1.SOPS) (string, error)
Constants ¶
const AgeSecretKeyPrefix = "AGE-SECRET-KEY-"
AgeSecretKeyPrefix is the prefix for Age private keys.
const (
// SopsAgeSecretName is the name of the Kubernetes secret used for SOPS Age decryption.
SopsAgeSecretName = "sops-age"
)
Variables ¶
var ErrNoMatchingAgeKey = errors.New(
"no private key matches the configured public keys",
)
ErrNoMatchingAgeKey indicates public keys were configured but no matching private key was found.
var ErrSOPSKeyNotFound = errors.New(
"SOPS is enabled but no Age key found",
)
ErrSOPSKeyNotFound indicates SOPS is explicitly enabled but no key was found.
Functions ¶
func BuildSopsAgeSecret ¶
BuildSopsAgeSecret constructs the Kubernetes Secret for SOPS Age decryption in the given namespace. This shared helper is used by both the Flux and ArgoCD installers.
func ExtractAgeKey ¶
ExtractAgeKey finds and returns the first AGE-SECRET-KEY-... line from the input. Used for single-key extraction (e.g. from env var).
func ExtractAllAgeKeys ¶ added in v7.4.0
ExtractAllAgeKeys extracts all AGE-SECRET-KEY-... lines from the input.
func FilterKeysByPublicKeys ¶ added in v7.4.0
FilterKeysByPublicKeys filters private keys to only those whose derived public key matches one of the given public keys. Uses age.ParseX25519Identity to derive the public key from each private key. Empty entries in publicKeys are silently skipped.
func ResolveAgeKey ¶
ResolveAgeKey resolves the Age private key(s) from available sources. Priority: (1) environment variable, (2) local key file. When extracting from a key file, all keys are returned and optionally filtered by SOPS.Extract.PublicKeys. Returns the key(s) as a newline-joined string, or empty if not found.
Types ¶
This section is empty.
Source Files