creation_rules:
  - path_regex: secrets/.*\.sops\.ya?ml$
    age: age1replace-with-a-cluster-recipient