encrypted_regex encrypts more than configured

[Madic-]

sops encrypts more than I have configured in the .sops.yaml file.

I have the following k8s helm values configuration:

---
clusterCollector:
  ingress:
    enabled: true
    className: "traefik"
    annotations:
      traefik.ingress.kubernetes.io/router.entrypoints: websecure
      traefik.ingress.kubernetes.io/router.tls: "true"
      traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect@kubernetescrd
    hosts:
      - host: fqdn.example.com
        paths:
          - path: /
            pathType: Prefix
    tls:
      - secretName: wildcard-cloudflare-production-01
        hosts:
          -  fqdn.example.com

my .sops.yaml file

creation_rules:
  - path_regex: .*.yaml
    encrypted_regex: "^(data|stringData|email|dnsNames|hosts?)$"
    age: age1....

Expected result:

---
clusterCollector:
  ingress:
    enabled: true
    className: "traefik"
    annotations:
      traefik.ingress.kubernetes.io/router.entrypoints: websecure
      traefik.ingress.kubernetes.io/router.tls: "true"
      traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect@kubernetescrd
    hosts:
      - host: ENC[AES256_GCM,data:Xxnj6+pRnwYcl83W+9ZbyP2OYmG+IAOdKj9acZqKQgAbs1GiFNjXJD3/,iv:D97v8RPTFzub8/jQGRIRHAB149P0PkikeY/V1D3OiaY=,tag:Fjq0730CuFhX0fquQgY4yw==,type:str]
        paths:
          - path: /
            pathType: Prefix
    tls:
      - secretName: wildcard-cloudflare-production-01
        hosts:
          -  ENC[AES256_GCM,data:VFzF4sfRpuBVtgSqP/dusutwsDCJcGJeqgRIIcSNl3AO4OVtMDV5/zJO,iv:W+TzRYVt4dHiDxjCmixhXdvnRT28RxtYiAK9xJzWEz8=,tag:XtgjVev+m8rmqBz5R3GyfQ==,type:str]

Actual result:

clusterCollector:
    ingress:
        enabled: true
        className: traefik
        annotations:
            traefik.ingress.kubernetes.io/router.entrypoints: websecure
            traefik.ingress.kubernetes.io/router.tls: "true"
            traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect@kubernetescrd
        hosts:
            - host: ENC[AES256_GCM,data:Xxnj6+pRnwYcl83W+9ZbyP2OYmG+IAOdKj9acZqKQgAbs1GiFNjXJD3/,iv:D97v8RPTFzub8/jQGRIRHAB149P0PkikeY/V1D3OiaY=,tag:Fjq0730CuFhX0fquQgY4yw==,type:str]
              paths:
                - path: ENC[AES256_GCM,data:/Q==,iv:vtlNgvBhv1fMZiFg8EuZzTbP7Htu89+bk45YE9psBts=,tag:a8D5wdDY/6OkhDs1RoxoJw==,type:str]
                  pathType: ENC[AES256_GCM,data:0sw6Ignl,iv:j1OGgyu5vneqKaKBxUwztA4QgsBA6fLpfHZN0pQvhbY=,tag:XQqVlc4zLR2RltEhl8JqxQ==,type:str]
        tls:
            - secretName: wildcard-cloudflare-production-01
              hosts:
                - ENC[AES256_GCM,data:VFzF4sfRpuBVtgSqP/dusutwsDCJcGJeqgRIIcSNl3AO4OVtMDV5/zJO,iv:W+TzRYVt4dHiDxjCmixhXdvnRT28RxtYiAK9xJzWEz8=,tag:XtgjVev+m8rmqBz5R3GyfQ==,type:str]

Why is it also encrypting path and pathType?

[Madic-]

I think I understand. Because it's matching first "hosts", it encrypts everything beneath.

[devstein]

@Madic- Hey again 😄 yes that's correct