.sops.yaml

creation_rules:
    # By default allow following keys to encrypt/decrypt secrets
    # Specific path can be configured as explained here https://github.com/mozilla/sops#using-sops-yaml-conf-to-select-kms-pgp-for-new-files
    # !  The first regex that matches is selected
    - path_regex: secrets/config/incrementals-publisher/secrets.yaml
      key_groups:
        - azure_keyvault:
          - vaultUrl: 'https://prodjenkinsinfra.vault.azure.net'
            key: 'sops'
            version: '252fc7e646ac40f184ab4a6016484725'
          pgp:
            - '88FABF5F307FB5870B6AD2E8A266F2D3F9D60C45' # Halkeye
            - '6699E555C6730CAED9083B7AD40F4AD2F55AF15F' # timja
            - '29B84443F41DE582F71599AFB47082DEE225AE06' # dduportal
            - 'E104B7543ECCCC68EA1EB35DD9B2DBFB59AD8344' # markewaite
            - 'DDE4B4D6771E87C612ED990D1110C7B1CA22ADE9' # smerle

    - path_regex: secrets/config/plugin-site/secrets.yaml
      key_groups:
        - azure_keyvault:
          - vaultUrl: 'https://prodjenkinsinfra.vault.azure.net'
            key: 'sops'
            version: '252fc7e646ac40f184ab4a6016484725'
          pgp:
            - '88FABF5F307FB5870B6AD2E8A266F2D3F9D60C45' # Halkeye
            - '6699E555C6730CAED9083B7AD40F4AD2F55AF15F' # timja
            - '29B84443F41DE582F71599AFB47082DEE225AE06' # dduportal
            - 'E104B7543ECCCC68EA1EB35DD9B2DBFB59AD8344' # markewaite
            - 'DDE4B4D6771E87C612ED990D1110C7B1CA22ADE9' # smerle

    - path_regex: secrets/config/plugin-site-issues/secrets.yaml
      key_groups:
        - azure_keyvault:
            - vaultUrl: 'https://prodjenkinsinfra.vault.azure.net'
              key: 'sops'
              version: '252fc7e646ac40f184ab4a6016484725'
          pgp:
            - '88FABF5F307FB5870B6AD2E8A266F2D3F9D60C45' # Halkeye
            - '6699E555C6730CAED9083B7AD40F4AD2F55AF15F' # timja
            - '29B84443F41DE582F71599AFB47082DEE225AE06' # dduportal
            - 'E104B7543ECCCC68EA1EB35DD9B2DBFB59AD8344' # markewaite
            - 'DDE4B4D6771E87C612ED990D1110C7B1CA22ADE9' # smerle

    ## Default fallback (for all files not matched by previous rules)
    - key_groups:
        - azure_keyvault:
          - vaultUrl: 'https://prodjenkinsinfra.vault.azure.net'
            key: 'sops'
            version: '252fc7e646ac40f184ab4a6016484725'
          pgp:
            - '88FABF5F307FB5870B6AD2E8A266F2D3F9D60C45' # Halkeye
            - '6699E555C6730CAED9083B7AD40F4AD2F55AF15F' # timja
            - '29B84443F41DE582F71599AFB47082DEE225AE06' # dduportal
            - 'E104B7543ECCCC68EA1EB35DD9B2DBFB59AD8344' # markewaite
            - 'DDE4B4D6771E87C612ED990D1110C7B1CA22ADE9' # smerle