build/diff: strip SOPS metadata from non-Secret resources

[SebTardif]

Summary

This PR makes flux build kustomization and flux diff kustomization safer and more compatible with SOPS-encrypted non-Secret manifests (e.g. HelmRelease, ConfigMap) by stripping top-level .sops metadata from non-Secret resources in CLI build output.

Why

When .sops metadata is left in non-Secret resources, server-side apply dry-run can fail with schema validation errors on CRDs (e.g. .sops: field not declared in schema).

Changes

• Extend maskSopsData in internal/build/build.go to clear top-level .sops for non-Secret resources when detected.
• Keep existing behavior for Secret resources.
• Preserve ENC[...] ciphertext values (no decryption performed in CLI build step).
• Add unit coverage in internal/build/build_test.go.
• Add build command tests and fixtures in cmd/flux/build_kustomization_test.go and cmd/flux/testdata/build-kustomization/*.
• Add flux create kustomization decryption golden coverage in cmd/flux/create_kustomization_test.go.

Validation

• make fmt vet
• make test

Related context: #4075

[Copilot]

Pull request overview

This PR improves flux build kustomization and flux diff kustomization compatibility with SOPS-encrypted non-Secret manifests by stripping the top-level .sops metadata block from non-Secret resources in CLI build output, preventing server-side apply dry-run schema validation errors on CRDs.

Changes:

• Extend maskSopsData to clear top-level .sops for non-Secret resources when SOPS metadata is detected.
• Add unit tests covering .sops stripping for non-Secret resources.
• Add CLI build/create kustomization golden tests and new testdata fixtures for SOPS scenarios.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/build/build.go	Adds .sops stripping for non-Secret resources during masking.
internal/build/build_test.go	Adds unit coverage for .sops stripping behavior on non-Secret resources.
cmd/flux/build_kustomization_test.go	Adds integration-style golden tests for building SOPS-decorated HelmRelease/ConfigMap.
cmd/flux/create_kustomization_test.go	Adds golden coverage for create kustomization decryption flags output.
cmd/flux/testdata/create_kustomization/with-sops-decryption.yaml	New golden YAML for create-kustomization decryption flags.
cmd/flux/testdata/build-kustomization/sops-helmrelease/*	New kustomization + HelmRelease SOPS fixture.
cmd/flux/testdata/build-kustomization/sops-helmrelease-result.yaml	New golden output verifying .sops is stripped from HelmRelease.
cmd/flux/testdata/build-kustomization/sops-configmap/*	New kustomization + ConfigMap SOPS fixture.
cmd/flux/testdata/build-kustomization/sops-configmap-result.yaml	New golden output verifying .sops is stripped from ConfigMap.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[matheuscscp]

Hmmmm encrypting non-Secret resources is so bad...

[SebTardif]

@matheuscscp > Hmmmm encrypting non-Secret resources is so bad...
"so bad..." is way too strong
It's all about tradeoff. In practice, if credentials showing up in values of helm chart can be encrypted more easily, then overall things are more secure. We covered some of that in #4075. It seems stefanprodan was open to the idea if he didn't have to code it himself...

I worked in many projects were the credentials are showing up in git and logs. I want to make it easy to avoid that. Ending up with credentials hidden inside Kubernetes that is not in a secret and that nobody has practical access, is something my projects accept totally.

[stefanprodan]

I'm OK with this change if we put it behind an opt-in flag like --strip-sops-metadata. While diff will no longer error out at dry-run, it will always detect drift, which I guess is fine.

[SebTardif]

Implemented follow-up in ce8d638:

• Added opt-in --strip-sops-metadata to both flux build kustomization and flux diff kustomization.
• Kept default behavior unchanged: non-Secret top-level .sops metadata is now preserved unless the flag is set.
• Preserved existing Secret masking behavior.
• Added/updated unit coverage for both opt-in and default paths.

Also verified the two Copilot findings are handled:

• structural lookup for top-level sops field
• proper error propagation from PipeE