feat(sops): Update encrypted regex patterns and add release configuration

TheMeinerLP · TheMeinerLP · commit ef11b5823ad9 · 2025-09-28T20:32:36.000+02:00
diff --git a/.sops.yaml b/.sops.yaml
@@ -8,7 +8,7 @@ creation_rules:
   - pgp: 0231831CB40B8E587B7353CBA3AF727721205A62
     path_regex: .dockerconfigjson
   - path_regex: .*.yaml
-    encrypted_regex: ^(ca_password|provisioner_password|intermediate_ca_key|root_ca_key|\.dockerconfigjson|sql\.php)$
+    encrypted_regex: ^(ca_password|provisioner_password|intermediate_ca|root_ca|intermediate_ca_key|root_ca_key|\.dockerconfigjson|sql\.php)$
     pgp: 0231831CB40B8E587B7353CBA3AF727721205A62
   - pgp: 0231831CB40B8E587B7353CBA3AF727721205A62
     path_regex: s3.conf
diff --git a/infrastructure/clusters/feather-core/base-controllers/step-certificates/kustomization.yaml b/infrastructure/clusters/feather-core/base-controllers/step-certificates/kustomization.yaml
@@ -3,4 +3,4 @@ kind: Kustomization
 resources:
   - ../../../../base/controllers/step-certificates
 patches:
-  - path: release.yaml
+  - path: release.sops.yaml
diff --git a/infrastructure/clusters/feather-core/base-controllers/step-certificates/release.sops.yaml b/infrastructure/clusters/feather-core/base-controllers/step-certificates/release.sops.yaml
@@ -0,0 +1,123 @@
+apiVersion: ENC[AES256_GCM,data:jc2+ZAnORWTMHReOSXHpci7BVxNBC5nrDA==,iv:62MPn0ZalzTgVhz5Xg0y0r6VUCAmYKR5D1wahqEd8EI=,tag:Wz7EJIUjMaw3O4DHHerB6A==,type:str]
+kind: ENC[AES256_GCM,data:WxC3WF35zI7HdZs=,iv:WZgGcSQ3i/NFqlTL6dqB8W/9TuotzkssREpOM0MF39o=,tag:526b1+3J9noPlQZW/lBUgQ==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:wi6h6NBrrA==,iv:0on68XYhQdpWiXj/l0Zb9r6+3xL6ngXvtXdibYDlGJU=,tag:oTB1C8z9G2Ye8f2/+dXg/g==,type:str]
+    namespace: ENC[AES256_GCM,data:zbGIah4gHQ==,iv:+zZBapBRG5Nmm2x/qBtfnbBtKKhFtwml//YKyWDNZGo=,tag:iLPWK7ZmctCXsGWu6p+Cxw==,type:str]
+spec:
+    chart:
+        spec:
+            version: ENC[AES256_GCM,data:8ye5BtSetl4=,iv:uyWGUX9Uqeo5BFiff8eTYlKbGsdADScaEvnakNE1zLs=,tag:4KknMfDPnHlbpwzDI41ArA==,type:str]
+    values:
+        autocert:
+            enabled: ENC[AES256_GCM,data:2i6hmg==,iv:n9cA3dB5YpiF4dq8hQkqTsCrBa6OuBnI5TbjlgDpiKM=,tag:qF6oeUdrd+3Hdj7HIRlSbQ==,type:bool]
+        inject:
+            certificates:
+                intermediate_ca: ENC[AES256_GCM,data:LW9lK1zPN6dHN3HJW+SD5Zu0HYRPKn1Ijqp2m7cJVdRv2ijgO8wpqs8ll7cA0y1I99frXkmtbiWkW5t8Qlb5Ekix2NP7lDti1Ly/ALU4z2e7mW4gQK4qAjCa1fMRcwDgZi9dGjgnctnn0lolPXY/vZ2pWUE0r7VqtPq3QwR1NQR5IqOSL5Q+GOfWDe9Jh1Xz216be1uRyQdyNnbdKnKM4JUtMizBOWXh5Grea94v/UoQiNky4eqYDzsjLYnYKeblELHnUXFo1i37NMcThY8hQWoc7sgaLQfueENWad4dMXSAJoMXmtrzJGsH2hWNFG/PrwVkLC07yU2K8lIWyp0nRE2S2DYY+oDaKUL0gDwyF/uwb9P0g/CWeiJHTZwaOYcRyl7etSGIXXhRQqlbW4z/Pa5/8SReNOt4NLvvcSu5D3KPlPfjWhPXTn8zApV69Y1LK99R9YyNBqP2nFBppIJNqbirbkZrnF6sFAzfb/ReRxkl8BWLb4luRtffgFYU7QAX6eDY34erp/f5mrpQVP5oIshIsnCti7GssWy8EFAJYDjGZfoR5KtCpOlmUPHYQ/Pj0bmHHyO03TCxIKuf5dX8hcVDw05VrcX/dj63NHjyv8wSSnPlp+3+2pFUFXXWaZ2CZcrkbmCTjGGy8Zcc64IjjWbKczPCmeEB2nHitNfZuHrqR4uP+mJpSGl0lOAr8flYFe3NvXPIpHi3RAn3fNm/eS29yRexAb1kD6y7dtBJuq/gh6spJONoAjcgI77bz9ddvR2wLhCPt+/TcVFhDsV6C13iXEJiP+jao5s3UyFRJ40O1vcYzkdDOJdRcm0TW+yMiFBZXmMlQipfpME2Lp0rWuygtzfkE08XdSW8j2wmC5aJNuYOUGfWieZdHxFxiTEMiSnk3c2D7muX2krQ3ZjnBYjzURNmGstAZtLwFx/TrhsZv0e0AA2rWTKedUYWjjFXjedXpBcdHAKJ,iv:A/1UqdEjJm70ysySWRe4ptF620XAGLrxsHNjUxtNPgI=,tag:hThaSTiLuOblLun6ufYFaw==,type:str]
+                root_ca: ENC[AES256_GCM,data:uOUcRLikSGI08pEBMOTl5WWI4RykDh2NnNDb4EUZ/xmEjDM2alsS62orQOSw3WBxbQ8sDsRnhMN0tr/u5CZi4cNET8S+akv4D4wWUTC4QBTCXejauMi1Q+7wCCW9FzrbzI9/gAHACwKWNrFN1GPukHzxzTP9kZR072bUIXrqTGKuHGdLee3YT20qQbxoGdfzm+DAgXEdqAJMFyJstl+I21nbFSk21hq6MMafJwsYRWAfiOLZuXpnvcq0bMjR5yf42GLgWgDo1PiL17Hs3V+0hAbVqVYA6eZS7eOZGkCbYRB5WJTrlFeUW46LHFrmdt4FB6Y5J7jw/bLmDSu7/rVT62EuJiqpJK+FJDFlXuNlhyDVAKWJ+NHPE9rAt37C/pS8IMbRD63jY50zlTrIsFjl5m/4nHtKP/4n2Lppk24TG4sk/AXKgLns22unZ4Y7Xghl7yKKJlPFYuzbA8b7s94Vz+wqSNsU3zpFaDfXxtswX/YfVD+qsdPhnW8WYVaBjH8n2i71SW43hY30ZBD4wptaPPdSzEAjGQP1vC1P0R+/BD9INvFAezFjDnpeNQ9wnK9QZtEst9rPEQdYJz59ujL/diyYnmABtOvEL+GYhLVtsQQoJZ4opAy+Yk+lhxSbK0RWTOFqI02DZrMJNyoIagWeHZJ6XZEPXrPGU++Uc2842PBeGbzPsYyaTn5Ym+BNhQOZWx7kQqgiwpXRSUZ6siGEDEbOTE9jZlE5feD5HBvH4YgrP/F5A9/jShcCJ33X/vThlup0v7Ezl28iRTrV3IEsW56I46jD7kkCPQxiq01UUZ8fbqWWzDjDTyUb8EN3fVtB+HaGSphfEVVl2IZlHwQNUm/kwtkCP4sRc+RXPJHwwJdjqX9mMvWhOJgYs4pEZZh7,iv:hIgwQLooVZ/mlXvWd/JXEdVZU8+DSK0gCJtiV4tIU/c=,tag:wj95AYRCeXOks53j+LWWag==,type:str]
+            config:
+                files:
+                    ca.json:
+                        address: ENC[AES256_GCM,data:u2w2RfE=,iv:icUg8PN9dOiqlAeLmg0xQtk+/oXhdhS5wZSYnl5f6v0=,tag:LlvJUq7k5QXvgH39wy6CMw==,type:str]
+                        authority:
+                            claims:
+                                defaultHostSSHCertDuration: ENC[AES256_GCM,data:+suVyw==,iv:zrr1iZrdWSJ06Mndfxp5RYasaj449gKY/adVlPZ5nr8=,tag:nBPdp/xqODwdJRGcQlEEwA==,type:str]
+                                defaultTLSCertDuration: ENC[AES256_GCM,data:RLzfuvU4,iv:uTFuDDvNwJgdROFKWrRfqWnT7NuxT1YwBP4dA3MnkuU=,tag:L3Uucvf38H+9MSZaaNX9NQ==,type:str]
+                                defaultUserSSHCertDuration: ENC[AES256_GCM,data:TdOd,iv:2G+oaUnJ2udlQ4sOy+y3oWmcVLrn47X0sNmp/Wv06Jg=,tag:6SUlYInpsvJSEaFfnQM6rg==,type:str]
+                                disableRenewal: ENC[AES256_GCM,data:BM6qLb4=,iv:v+MN/RRa5mH1lfeYaDzM59yw/21wjXZklnYjlNBoUGI=,tag:AI5EiYeA7nxTe4nEWlWBGQ==,type:bool]
+                                enableAdmin: ENC[AES256_GCM,data:w28765E=,iv:kx4gPnRHD6U2zJcl8z6PKjZs16s1EHqVxqYymkUHZ7k=,tag:v/SskB59KJs0C5fRH0SWHA==,type:bool]
+                                maxHostSSHCertDuration: ENC[AES256_GCM,data:+67z/HY=,iv:w7KrhChfunO5J7utjfSibD9Lu7Lwe+BGp+wxVdi5ImM=,tag:XcVAJda/gtkjFla04B1k0Q==,type:str]
+                                maxTLSCertDuration: ENC[AES256_GCM,data:oMzPAvLx+w==,iv:ornXOAuNtc2jcrUEb8ZToJuPeorFkwXHl8eQKIN3MWU=,tag:XEw0ZUWQ6vikcwJjzJTCZA==,type:str]
+                                maxUserSSHCertDuration: ENC[AES256_GCM,data:Pzlt,iv:UP8QUwLNrq6+aybMjXo9rGBCJcqpOIt/RrG1DDmPiB4=,tag:Kw7kPhcOyLNFiTIGj3lfrA==,type:str]
+                                minHostSSHCertDuration: ENC[AES256_GCM,data:msU=,iv:gy5UXNfByASlRkzxISNXJdmZxyuCrxSTzzjD5CJARR4=,tag:7mFhNU3OG3dbbW8KC/Hmfg==,type:str]
+                                minTLSCertDuration: ENC[AES256_GCM,data:olg=,iv:c/IUjVFFZSYIyxyUbQMbsqN1BFb9OYuqQ5EPpiT11Uo=,tag:uykop7nk42WvCFAZ0gsGJQ==,type:str]
+                                minUserSSHCertDuration: ENC[AES256_GCM,data:mg4=,iv:OPbHT14BxatqQaaiIvfHd+0V8dN3cKh98+YrAG+FWlQ=,tag:vEW8RHanTG1W4Amzu4Xqtg==,type:str]
+                            provisioners:
+                                - encryptedKey: ENC[AES256_GCM,data:Bu998U+FfZhLRCwjWFgtfyhR9egrIpoV2olIJ2vwU9iCUaXNCYLs3LEm4zaRDig8Rq38zoxQTTDoZ+buBTIAshzW3SSOxuvo05bZHqCkdP/bNSVSsyQ8SCopIkomqSo2zVHCKj4bY3EkJEQ/wKpplOwERSkTfdKpwCVNl7+hw9egnQvKGZe+P9aQLKWL/BvtdVaCBg6amghr75JjU8qEg3EWPumuMD1hNGFYbZSRzDWxXFwaajK/s1dY8lOhTcuKXnJoqx8tGeCuzsus7sN76ozX0Dm6V/gH3C4VnHv9Ig8gzCr/dg/tkJ4RfeWLUOPdu3Rb5ouN4hxFk+yOpPFdDZexS2oS/CrmQWh9Dc0KzdaQodGj6/Cd3OE1Tjc3l7hfEXHeEZ3WMBxM6pnCTSeCATq3XLQ4j+SNC5UUVHujstuJxzrk6JXLGkFClmVC2XLwqJZVJxW5K5qBl1o3dlCbWByRONd9gTGSH1RVu8nzEIsuglNPpl8RsYTbCr03eofOMcC+gNIiwI2ZTE44b77Wmv2rLw+rYiGiV//NzbyG84iJyO4H3gk9tcRqRCmKeIk6bIntVzXR2Y29nBB791rzluM7BD3q0fCigpBWrQs57+3uqs3/5NUdXyg7ys+FwJYge6bbvkcK089toaBmmuxFT3MGDqBpR6Pf9IOkbi5WsFm2f3SBN49WI2SM55HmtfBuui2wKt51ZzmuAf6vRDjgVrMeHgIHUhmRr6m3i08TYedVsarIzcdI3TxZ/OV1dIk=,iv:lKUbDp8FkHcImPmlCKKwCXahzTng2XtIaPbMeipYnII=,tag:tPrr+r+mByeURW0PAyBS2A==,type:str]
+                                  key:
+                                    alg: ENC[AES256_GCM,data:WXW3t/U=,iv:+6rrr75NDpPgkJR30l1T9tiHp6LPaU7PjkRABHUpOVQ=,tag:2iNrQvf9w9EoLSuoyX27tQ==,type:str]
+                                    crv: ENC[AES256_GCM,data:KIr18ng=,iv:1f9pivORribzIdSFjgYQv72dwJieJzaoUmC2JEk9pKE=,tag:kv6xiaYagqUWWhSYcGU72A==,type:str]
+                                    kid: ENC[AES256_GCM,data:tMlBq8Ww8UlV/1xTGMqhEUTTu5BOV4dbyWB3QKdoWy4ksOL0mF1XnglSeg==,iv:LkyzpJJlgE4M4JhRlTQT2t+7aMahgIa7ymaQZqUeYK8=,tag:OyrqkmCHIUvRFcVVk7jSNg==,type:str]
+                                    kty: ENC[AES256_GCM,data:kZk=,iv:0Jp3TscObbSA/dve29NMNb6Oz5QtBeF/Mcu2uor9SYw=,tag:DPdpJColsRSbwryJRGfBUQ==,type:str]
+                                    use: ENC[AES256_GCM,data:cimR,iv:gm3CV+MjluwdyX7zSecceUe2kMfBES9LpTSfJGDTEPQ=,tag:su6J31hwnqKbCnrpkbPtLw==,type:str]
+                                    x: ENC[AES256_GCM,data:GM/nU6Xz6UfFd5zeJbmzV64yRzQGdTYz+VqkOJ+SHJgRM2uyGZbBxBQTDA==,iv:pNVKB2EV1+NmSWczG6S2gbL/krnjs+fhpP62toycZPE=,tag:jfCACNWAm7mq4BmoVj83gg==,type:str]
+                                    "y": ENC[AES256_GCM,data:K1SlGHcLLNEIn/mB0iKK+nxnJHIh+sersSGWbKYv9F8I9YLh6jk0fo3Big==,iv:lVbtZ9w+MieAJS8GuQ4EbGzbLqtgqxnjRhL+Mmm9s3A=,tag:ZGfMuqweFrs9mmRIdfDZtg==,type:str]
+                                  name: ENC[AES256_GCM,data:/2AT5f7eWPBLEpR9wiBGE4VKPKku515n,iv:eNnKMABvJwTasai/ftKN9D0/kOleV/IYwoWSBqd+Bts=,tag:OHLx3mLAyQG3mEx9AD7Rdg==,type:str]
+                                  options:
+                                    ssh: {}
+                                    x509: {}
+                                  type: ENC[AES256_GCM,data:l0Uv,iv:8Y0gnexdn8SRtijbN8ty4t7UFkjAhhSwAj1GHsVgO7o=,tag:q06jfF5UqaiVWhU24nM5uQ==,type:str]
+                                - claims: {}
+                                  forceCN: ENC[AES256_GCM,data:0fm5aA==,iv:a9q4lEjbJhix0HljFt1e16xStpNfPOaKh6SUDEhb3Q0=,tag:iDHaYV3Z36yWrOze4uOBww==,type:bool]
+                                  name: ENC[AES256_GCM,data:E36/hQ==,iv:bSeA+DVWYVmpn6UyZmoi6lZGmdWXmcR8gE0Te5c59xk=,tag:zXkZqfqOCl7+QnGJWeqwPQ==,type:str]
+                                  type: ENC[AES256_GCM,data:AGASqg==,iv:F5U7SyPemYWVofNKz7V2SG4LkNFsAOLVlc42ejDUnso=,tag:dT1ng1vOcg1ka1D6wPUgLw==,type:str]
+                        crt: ENC[AES256_GCM,data:D1d10Ral7XzlcSZY5PYR/k7VFf65uQI575W9gjNnS/sA6kuc,iv:zkA37FjTtj7Pk+zhK+UjExYVudEjDenO9pouITogP70=,tag:BPNHosXTfjtiPAo05nzB/A==,type:str]
+                        db:
+                            dataSource: ENC[AES256_GCM,data:cmFP4Py4hd7UBD+q2A==,iv:IRqR+RkXvHnKoyhsg45IRNAeEfrvROQed6GpUPK/j3k=,tag:n0dqiPkOAUh+TFE82Nw5mw==,type:str]
+                            type: ENC[AES256_GCM,data:z27yF2rDH9A=,iv:TqJB13Suppw6VKEcNrI5f2PdbwZBjxr9bTYwZn2zu/Y=,tag:M50cEedQHbmrfrlqkbPunA==,type:str]
+                        dnsNames:
+                            - ENC[AES256_GCM,data:3h3gqWBudD7mHCqSsHfla7QD,iv:haEoqzJi8gRiZYtQyMfS0ElP7w+s1WDEkVQEc7iYzPY=,tag:0dmKenzUzlzH5FEBdex5Pg==,type:str]
+                            - ENC[AES256_GCM,data:1tu5OKc8kuqbNbBGKx2V5Td0OfZoxDjF3dcPaksdH6zQ9L3Uexu+YOawvCT7QgcyBLJl,iv:thEmfpb5+hC74IDRB5UaEPsLaycQ54N5HO8A3MXKEcA=,tag:6Zd6L/vvpUIuTgJcLFSxhw==,type:str]
+                        federateRoots: []
+                        key: ENC[AES256_GCM,data:tcf3bOuq7AI7+JfStMaDVpmggRy1VUT2nyMLqfBE0H2me5JoDV4=,iv:9F1DbzfWp1K6zTb7GTueWskAfaJkDWeZGy8ZfGbNaaQ=,tag:QhcMWGCn2+rJLB/XbNTlMw==,type:str]
+                        logger:
+                            format: ENC[AES256_GCM,data:m0dJOg==,iv:syN7EmoV6V4O+zgtYVAYKrGaL6hMzg6jpq1Ii5Fuf98=,tag:9nozr79TnKY6K48awPpisQ==,type:str]
+                        root: ENC[AES256_GCM,data:3GTSA+Y+vZ7eAjTf774tK0LpW7sUrzPzpGsqzA==,iv:J/oGDE4G3y9PmFvMLKBBk/C5Qig/c8qIjWHAWk0uIEE=,tag:6834+95NC5HW2FlGqBh/1g==,type:str]
+                        tls:
+                            cipherSuites:
+                                - ENC[AES256_GCM,data:lXXfgWciLQiAjmmY54HPc71nkmai6dNoATn7GyS0vSX0i7k4rtYw6QoXb5zU,iv:rIizCBCmJDKVI7fILRO7OPmxjDrQA3JEJrpNmMt0TOg=,tag:o3GAmGYgLE1TD4XbOnNu+Q==,type:str]
+                                - ENC[AES256_GCM,data:MdT7+hNRvvhzPzOmN0UtVH/vUfm93KVZfTOYH1XrnMAB8QgKw8ZS,iv:IBa02Bi0kXo6gLpwYhkPiQCQkpCgMQcLfxKD9B7E6Vc=,tag:2/9cHuG5t4biTrq1QoMx4A==,type:str]
+                            maxVersion: ENC[AES256_GCM,data:MCt5,iv:5wvHpxdbpgxOh9+NeFKR9lSZeYzVoMGopT0qfCED6Ik=,tag:z6jjio0YiUpIX/wWs+HiMg==,type:float]
+                            minVersion: ENC[AES256_GCM,data:ZNcr,iv:Y2b89r8cNhIJV2VEIvdZO9/Lk1q712Ps592ONSHDKRY=,tag:7xOc00xWqzplbtfkxD7gKQ==,type:float]
+                            renegotiation: ENC[AES256_GCM,data:c5z5x/A=,iv:K7EC2RcYw0wYMptwboQ4FNn1AVIH/I5RIZLAR6WBses=,tag:Nnxq2osMmK1pbXrnnYCSHQ==,type:bool]
+                    defaults.json:
+                        ca-config: ENC[AES256_GCM,data:j/FycniDeASF8bj2TFG23Lz1GWTxOnU+Jg==,iv:IXUiImlBAURC5VuWByQMnvvNFhiE1InY6aBepbSGq/c=,tag:iALbi07cS4p4EHdLuKvF0Q==,type:str]
+                        ca-url: ENC[AES256_GCM,data:uOsBYgIy6Ce2tpZX4GlJ63fiC92dBMeYtbz6pYXddA==,iv:2rtTzMX9RoJ3m0Xntxfk1ggXGQzTW3XQmI52BSdooRs=,tag:A6JbbXMgSmS8PRZQN5LFrg==,type:str]
+                        fingerprint: ENC[AES256_GCM,data:K2cWA7B8zouOM+K5yGdU+/Wyp6KoADHIatlD7STLqIpcCn/mR4ouF9hwmLmi1hfAtXHZDdtQqnU1mfx+kg2cGw==,iv:4ZmXVixdXPqd6Ih/aDddVKky8wdWghUM6P6mcKxAYrw=,tag:IxI/BhkF1Jp3Spkr2iG09A==,type:str]
+                        root: ENC[AES256_GCM,data:YntqflA+lZNGsjoZrAttOYXfjdpc4UgUVGr7dw==,iv:R8uhqv0PDl94GD6vsuic/S2M1N7hLhRZBc54742flgI=,tag:DNucF/sXnJa6dL+mi9noDA==,type:str]
+            enabled: ENC[AES256_GCM,data:Unw/EA==,iv:aXANHJ3/pp5c03SPIBlVFvqLnqvSAnbtO9lu0wXcEoE=,tag:KhSQdis4Cpmj/5gnvIueww==,type:bool]
+            secrets:
+                ca_password: ENC[AES256_GCM,data:NeJUUKyoN0dR46WTFmj9MkoLRPBy6qOaPk+ImRB+gsyDnM+Ww5/JJ0rSJ6A=,iv:mumaDpyv5WkCv8AcJ4FtNipoIuTOfRQaCoM18PrTy3M=,tag:mTBv1LWwTAMFnzrzRwAqfA==,type:str]
+                provisioner_password: ENC[AES256_GCM,data:zUYShbXuWBOVTqq9DhWx/k676MLHeJQ0GZ+cOiHLujAVgQYmbC0sFNpPE3U=,iv:JIdh3s4cpfH77tK6cN9ri0ER5r/w6efgByN6rbF/uqw=,tag:iYjBIM3Jjn39C08dw4waYw==,type:str]
+                x509:
+                    intermediate_ca_key: ENC[AES256_GCM,data:z+HAyvizs0mkp8e+2nMzbA7DNb9ChrbGQH3WzG6TnIS9Q5fX1htomBjkkbBNevUl4gJcY7c57nGeX0qS7jPC/qWcJ/RRIkSme5iFOimKJknEBf8ejKIs0kiOQqa0iBASF+EQDpoadlTcVTv038jORqeqSUinNfeQiVZAw6tNldHPr9x3EbUHF3kIKoEr7SLJ46zIdrltuvBNQ+SQ6rnIKNg2hb8DwjqkQfSTmRhTDgyG6kL0YS+2pX939Wrhq25EeDMMw5Z1OZSKx9QJ9NiOc61c7XCsppaHhK8kkR3ppV7pSOTcxYpTUPsnytBpAMZRAJSz3FDrW83205Io8co/ghexAl+z17pT0+GRjaarjKd8ItANM1opuuLNIiNgQvyoFWtA0BhMKrFyYNOMZRqw559LlWrjeVLFEcA=,iv:oaDJ0JJzSThMZOcxFZeOi03jBMN5V885oR9iuszkMj0=,tag:pUceendfbJEPJHBKNd+Asw==,type:str]
+                    root_ca_key: ENC[AES256_GCM,data:sk4l+p2R81APDtoWM6Aw5DZTwUXPUSj0peGZYykMdM4iiG3FhTwQZwPZFt0eZGKT/OPz7cIXtC0dN94qRwiEG/kX83WeKgpaZJBvWcWcC5fM13QVH1saUE5sJn38Njr5uo9Ou29I69LvJhuWOaTkUa3d2FRUMjHx9x6AGo1O+Ai4GPfS3odo2T2/vjMp/p4xExc42RHKLXN5nkmcLzc3/AYYWAc/RKXJ7ZFmUm3wEr2GyG9/Y04R3MjoyXYBaCOSFPPEQ3tIdUgR+luV8MdVqeiGXPkL3YXQBN8AfJETF22Qbwn5ChIB8S2JOzPwCCqQGd1tMSnuszHCX7/56TOoICKh9n619ZZtQ4PA1ESaKnsAimu8EO7s0bmzU1l5NhkVmQDrd3tb0ezOqdZqUY6UKx3R/I/Twg2+pvg=,iv:mU6GUAYqzErSvPRXxnHDekQCGiy54ywJ9JQjyVh7EiE=,tag:0Xeuz96uGCR3+JkbdmWKlg==,type:str]
+        resources:
+            limits:
+                cpu: ENC[AES256_GCM,data:UTCPWQ==,iv:t1XDuBWasdbMyzUZBNxQgQYfzH5GpZojtbq1lGtw30c=,tag:hMUjR+vRSRnOeVEftm5Xog==,type:str]
+                memory: ENC[AES256_GCM,data:Q22urQw=,iv:pqUTYSQP2rbK4ZaS4v5GaWMRXfcNmKN+CmZvrCioMhk=,tag:yKnv3zDDzxHKXIpLWzXMgA==,type:str]
+            requests:
+                cpu: ENC[AES256_GCM,data:LgYIfg==,iv:GAPKtUEfqXDeDnQYZWAqEelYOm9Vxe8Ok1tT2OnwHHU=,tag:izozCnav8Qcb3A5qHKSmsw==,type:str]
+                memory: ENC[AES256_GCM,data:BFm8e5A=,iv:WfzKIEy1MU0tiCogvi3++o0JzbF65xnH3bjS50Bt624=,tag:x/Eg0wK9OPRcDvWyXVu57Q==,type:str]
+        service:
+            labels:
+                onelite.feather/site: ENC[AES256_GCM,data:k9xCDw==,iv:45mryOjNTKltxu3o4BPnLZXvxhVUgUioI7RQNfDAFaE=,tag:oZ6nQVQREujUc7a5mhKx8g==,type:str]
+                onelite.feather/bgp: ENC[AES256_GCM,data:iBqd2Q6tyMI=,iv:UKLnX78nQNvxmiPSVC4N3xtTSBNInVYVy9aLSeZyWDQ=,tag:2BItQs2pXqBmBS6UgYUhww==,type:str]
+            externalTrafficPolicy: ENC[AES256_GCM,data:avFzxvM=,iv:bAzrkBl06CRfdrWUE4NET3dfTYeGXizDV90iuWYI0Ag=,tag:u4VxpQcZ44IIFwNrPLMkqQ==,type:str]
+            targetPort: ENC[AES256_GCM,data:FjYpQA==,iv:AKVH1nWp+ZWQzLmzTFPvXdnZVhxJn+PYMN85pp0+4XY=,tag:6Nc9+mSF4nst1QHvJ4/W8Q==,type:int]
+            type: ENC[AES256_GCM,data:UHVQwJ8O1agKDl9z,iv:EX7T3ZpX9CRahlZAvMsfgAtzVcNftSL+ybavDXUCX+Y=,tag:6FGZ8o8sjyM1qf9VDLKF6w==,type:str]
+sops:
+    lastmodified: "2025-09-28T18:32:22Z"
+    mac: ENC[AES256_GCM,data:CkednI+P5qBBhOKTicayEHrns7rEiafZgUts6UET1FIfrdXeiNv5MJFVvZJSYE9aMZREuxAUKUmVtOK+t5U4cUbTgBH7JXq1SNUjSEdnxPFkWEnfFVg75qVfx1HgHzO7UIsoAnEyz8Jyg7fJlt7m9XR0m55Omgy01qVAQZkGg4Y=,iv:H7kUW0mWAtvZI1fLjjWWZjwNaSW686XqZMbD7Eee8wg=,tag:oV7sNvbCl8ayuLdGtRRbyg==,type:str]
+    pgp:
+        - created_at: "2025-09-28T18:32:22Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwWbRp0WX+I4ARAAzArivmzhXYqeFe8bmUVrJQxR9dbHERkQQOcyNJlpJNDB
+            fRE2Lna34GtbbaFU74de/nPvJJGr6HZ8tLa4nhbkKDQIazghGnFsiPzokghq7FXl
+            TcOsJMWaUB87mzg0qvsh2kt8XM5oZA94NdVK26eRHFXeqic+MMQ7G0bh1+NcRvJ0
+            ZH1j4f4XehsYfFfpPZBAMPct7AERPNvKAulR7JaD7t409J7c4JA1djlhysMxBT8G
+            ig44KIDgsbVekkbZqqyysbBbNiRjt6/3FIVvbb18k7h23GpMoKvTGKBbaPFXLE5v
+            nOmPeACvdl4w4apU/HMzMH1nD3BK53CzLlonTe06AF5I13ygosGe2sMqK7yslaz5
+            7uE5EeE1hJgovlL4zxDgZcP2BmCoSg61f/rfnR8jQmvfBPn2JPjY2wv9RylpYk/b
+            9pjC1sKMRu/SOURsIy8d8WO8Ec0EYK5hplqPMYzFLAE1ifgXw3bqgMo8wlLa+nb8
+            1NFnnVoVLVuIHPXt25DZPX2P4UJOBn1TBLZnLL4IdkZyWtR3D6OYheF+qp7JKjqb
+            rFPJLAnzWhKynZDJD1754zZAm8U/MwT+K0hNevfer1cdClWwX5z9OcPZM7xODuV1
+            k64Xn3sBqiodEizEP5XHv14Uv+OGSUJhGXWR/UF227WboAxpvGzFqM0i3U71ymPS
+            XgFkq692cwZ8NMbpwh8eq1WFuZqrWwLzg2OHYydPt36sbUKBH7o8Rz3e0jZMM6bB
+            3WsfGDaCcGQqBySMB2Qeha44v13kpFaiiJEcVrpwciPZHF+bh4Vpv3be6OxHfvs=
+            =MlhB
+            -----END PGP MESSAGE-----
+          fp: 0231831CB40B8E587B7353CBA3AF727721205A62
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2
diff --git a/infrastructure/clusters/feather-core/base-controllers/step-certificates/release.yaml b/infrastructure/clusters/feather-core/base-controllers/step-certificates/release.yaml
