Do not attempt to "decrypt: disabled" objects

Author: danhubern

internal/controller/kustomization_controller.go

@@ -827,6 +827,7 @@ func (r *KustomizationReconciler) apply(ctx context.Context,
 	applyOpts.Force = obj.Spec.Force
 	applyOpts.ExclusionSelector = map[string]string{
 		fmt.Sprintf("%s/reconcile", kustomizev1.GroupVersion.Group): kustomizev1.DisabledValue,
+		fmt.Sprintf("%s/decrypt", kustomizev1.GroupVersion.Group):   kustomizev1.DisabledValue,
 		fmt.Sprintf("%s/ssa", kustomizev1.GroupVersion.Group):       kustomizev1.IgnoreValue,
 	}
 	applyOpts.IfNotPresentSelector = map[string]string{

internal/decryptor/decryptor.go

@@ -190,6 +190,10 @@ func New(client client.Client, kustomization *kustomizev1.Kustomization, opts ..
 // IsEncryptedSecret checks if the given object is a Kubernetes Secret encrypted
 // with Mozilla SOPS.
 func IsEncryptedSecret(object *unstructured.Unstructured) bool {
+	annotations := object.GetAnnotations()
+	if annotations != nil && annotations[fmt.Sprintf("%s/decrypt", kustomizev1.GroupVersion.Group)] == kustomizev1.DisabledValue {
+		return false
+	}
 	if object.GetKind() == "Secret" && object.GetAPIVersion() == "v1" {
 		if _, found, _ := unstructured.NestedFieldNoCopy(object.Object, "sops"); found {
 			return true

internal/decryptor/decryptor_test.go

@@ -58,6 +58,8 @@ func TestIsEncryptedSecret(t *testing.T) {
 		want   gt.GomegaMatcher
 	}{
 		{name: "encrypted secret", object: []byte("apiVersion: v1\nkind: Secret\nsops: true\n"), want: BeTrue()},
+		{name: "decryption disabled secret", object: []byte("apiVersion: v1\nkind: Secret\nmetadata:\n  annotations:\n    kustomize.toolkit.fluxcd.io/decrypt: disabled\nsops: true\n"), want: BeFalse()},
+		{name: "decryption enabled secret", object: []byte("apiVersion: v1\nkind: Secret\nmetadata:\n  annotations:\n    kustomize.toolkit.fluxcd.io/decrypt: enabled\nsops: true\n"), want: BeTrue()},
 		{name: "decrypted secret", object: []byte("apiVersion: v1\nkind: Secret\n"), want: BeFalse()},
 		{name: "other resource", object: []byte("apiVersion: v1\nkind: Deployment\n"), want: BeFalse()},
 	}