Exclude regex
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
(I mentioned this to a maintainer at Kubecon EU 2025, I thought I'd file an issue too).
Example from https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-users-and-roles.html#k8s_file_realm
Given a file like this:
apiVersion: v1
kind: Secret
metadata:
name: secret-basic-auth
type: kubernetes.io/basic-auth
stringData:
username: rdeniro
password: mypassword
roles: kibana_admin,ingest_admin
I'd like the ability to encrypt all of stringData, except for stringData.roles and stringData.username.
I want the explicit "exclude" so that I can be confident that new fields are encrypted by default.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how SOPS handles Kubernetes Secret fields, using the linked Elastic file-realm example as the expected use case. Determine where field-selection rules are defined and how an explicit exclusion could preserve encryption of new fields by default. Done means stringData.roles and stringData.username remain unencrypted while other stringData fields are encrypted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100