Recursively apply decryption stanza on kustomization files

[bmm-alc]

Hello,

I'm migrating to decryption in my git repo, the problem is I need to add the decryption stanza on every single kustomization file. Is there any better option ? I did not find a way to apply this on cluster kustomization that would apply this to all children.
Same applies for kustomization files created on the fly by fluxcd.

Best

[stefanprodan]

Flux objects are reconciled independently, from a controller perspective there is no parent/child relationship and this will not change as it breaks the design of Flux. You can write patches that target child Kustomizations in the parent with spec.patches or you can use the Kubernetes builtin CEL admission and inject the decryption stanza.

[tomm1990]

yeah - there’s no “inherit decryption to every child” knob on a parent Flux Kustomization.

two different things get mixed up here:

1. git kustomization.yaml files - those don’t take a Flux decryption: stanza at all. SOPS/age is handled by the Flux Kustomization CR when it builds that path.
2. Flux Kustomization CRs (kustomize.toolkit.fluxcd.io) - spec.decryption is per CR. a parent that dependsOn / applies other Kustomizations does not recurse its decryption config into them. same for CRs Flux generates on the fly - each object needs its own spec.decryption (or it just won’t decrypt).

practical options

• one Flux Kustomization, wider path - if you can point a single CR at a directory that already contains everything that needs decrypt, you only set decryption once.
• generate the stanza - keep a shared patch/component in git and produce every Flux Kustomization manifest with spec.decryption already filled (kustomize patches / components, jsonnet, helm, whatever you use to mint those CRs). that’s the usual pattern when you have lots of them.
• don’t hand-edit each live object - patch at apply-time (kyverno/policy / kustomize controller) if the CRs are created dynamically and you can’t change the generator.

there isn’t a cluster-level “default decryption for all Kustomizations” today - so either widen to one CR, or stamp spec.decryption onto every CR via your generator.