UNCLASSIFIED - NO CUI

sops-gpg creation needs updating

Version 0.10.0 of kustomize-controller https://github.com/fluxcd/kustomize-controller/blob/main/CHANGELOG.md#0100 introduced version 3.7.0 of SOPS

Since this change the secret key must have a file extension e.g. foo.asc in order for SOPS to decrypt it. See the example on this page https://fluxcd.io/docs/guides/mozilla-sops/#generate-a-gpg-key

Without the extension you get a very cryptic error message from SOPS and GPG when the environment kustomization reconciles, along the lines of "Failed to get the data key required to decrypt the SOPS file"

The command that generates the sops-gpg secret should therefore must now be

gpg --export-secret-key --armor ${fp} | kubectl create secret generic sops-gpg -n bigbang --from-file=bigbangkey.asc=/dev/stdin
Edited by Ben Coleman