How to configure the nested keys at encrypted_regex?

[jaythamke]

I have following k8s secret manifest and I would like to only encrypt the name under data object but the sops encrypts all instances of name. How to configure the specific nested keys to encrypt using encrypted_regex rule?

apiVersion: v1
kind: Secret
metadata:
    name: awesomeapp
    namespace: awesomeapps
data:
    .dockerconfigjson: Zm9vIGlzIG5vdCBiYXI=
    name: YmFy
type: kubernetes.io/dockerconfigjson

the .sops.yaml is as follows:

creation_rules:
- path_regex: k8s-secrets?\.ya?ml$
  encrypted_regex: '^(name)$'
  pgp: 5607E376BAEC53F90E91157A54C327E8F102B5A0

Appreciate!

Thanks and best regards,
Jayesh

[Zebradil]

It is not possible in the current version of sops. The regexp is evaluated against every segment of a full key path separately.
See https://github.com/mozilla/sops/blob/v3.7.1/sops.go#L339

Though, if the project was more actively developed, it would've been quite easy to implement.