intellij-sops-plugin doesn't respect path_regex and encrypted_regex in config .sops.yaml

[antonioua]

I've instructed sops don't encrypt metadata fields in my Kubernetes Secret with the following config .sops.yaml:

creation_rules:
- path_regex: ".*-secret.yaml|.*-secret.patch.yaml"
  encrypted_regex: ^(data|stringData)$
  azure_keyvault: https://xxx
- path_regex: ""
  azure_keyvault: https://xxx

But as a result I get encrypted both metada and data in my Secret datasource-secret.enc.yaml:

apiVersion: ENC[AES256_GCM,data:EUE=,iv:HTIqw0lOoUzwxMR5t7PihyP3wqBw4jkLjOUdX0Qq/Ms=,tag:wUfy5isnV1CYCDek5UEnHA==,type:str]
kind: ENC[AES256_GCM,data:zzYYjAkj,iv:SWmwGdqwAfo/9yBrBLkvPt12zoVhYlBjJoBbyVg9F1E=,tag:X9o9byzQ2vUJh7hnEtuYVw==,type:str]
metadata:
    name: ENC[AES256_GCM,data:YDi1NH/10KjCqdeNxe8b19L3Jw==,iv:F2JTPS1xDJiWt9S1ZA4sK3sQ9GIlaZJ0CMx7uf+kGUs=,tag:VW2WOvQNf9pBE1hSeqq7+A==,type:str]
    labels:
        grafana_datasource: ENC[AES256_GCM,data:hQ==,iv:qfZL9xZehxFtAAPZdyAnXgssq8YJgPTi4K5lj/IqFyM=,tag:FpsgH9j9LZr8zezWrOWScQ==,type:str]
type: ENC[AES256_GCM,data:Ke1N21eD,iv:R72nJnkhhJrfh9pMWhTKaOhhGD8k8HtX4ww2wuwWycU=,tag:EZ5KBhnc1RfG7xa2VEooog==,type:str]
stringData:
    datasource.yaml: ENC[XXX]

Running the original sops binary it works as expected and metadata is not encrypted:

sops -e datasource-secret.yaml > datasource-secret.enc.yaml

apiVersion: v1
kind: Secret
metadata:
    name: grafana-datasources
    labels:
        grafana_datasource: "1"
type: Opaque
stringData:
    datasource.yaml: ENC[XXX]

[DaPutzy]

Thats odd, we do the same thing and I am sure I though of that 🤔

I will look into that!

[DaPutzy]

Indeed: Because of this issue I implemented this:

public void encrypt(final Project project, final VirtualFile file, ...) {
	final GeneralCommandLine command = new GeneralCommandLine(...);
	command.setWorkDirectory(file.getParent().getPath());

...

}

to make sure my CWD is the same one the file is located in❓❓❓

[DaPutzy]

Is your file actually called datasource-secret.enc.yaml? Because than your regex wont match?

I just tested this in our repository and it works as expected 🤔

[antonioua]

you're right @DaPutzy that's because my regexp don't match, I need to modify it.
It works for the case when I do encryption with command-line sops and this confused me.

[DaPutzy]

I will close this issue, if anything changes feel free to open it again :)