cue kubernetes deployment service with an encrypted config

app.cue

package app

#Config: {
    hello_msg: string
}
config: #Config

deployment: {
    apiVersion: "apps/v1"
    kind:       "Deployment"
    metadata: {
        namespace: "default"
        name:      "simple-app"
    }
    spec: {
        selector: matchLabels: "simple-app": ""
        template: {
            metadata: labels: "simple-app": ""
            spec: containers: [{
                name:  "simple-app"
                image: "docker.io/dkalinin/k8s-simple-app"
                env: [{
                    name:  "HELLO_MSG"
                    value: config.hello_msg
                }]
            }]
        }
    }
}

service: {
    apiVersion: "v1"
    kind:       "Service"
    metadata: {
        namespace: "default"
        name:      "simple-app"
    }
    spec: {
        ports: [{
            port:       80
            targetPort: 80
        }]
        selector: "simple-app": ""
    }
}

all: {
    apiVersion: "v1"
    kind: "List"
    items: [deployment, service]
}

vals.sops.yml

hello_msg: ENC[AES256_GCM,data:RyelvDQk0rdvlIsq72bk,iv:hOHZoUtiCWG5cuA7apa6Xe7+1P2EZar641qfU7VUVz0=,tag:SS/qh4x/5C17g8jxv+oFbQ==,type:str]
sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age1s3z9duz8c856y6qwtquhcqt6svu5pzctycvcz8nw08es2n59qffs7usgr3
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArWlNJTTRGbU82a1FwTFJI
            ZmJCVmFSYzJPOU9JU1Z6Wi9Fbko5L3VVRndvCjhQckNLNy9sajF3SUxNSS83OUNW
            T2hxYVhvdFhDTG5sVFhucUhEMkwxVmsKLS0tIGNEYUpLb0JzeGgxeVBUZk9ublZO
            anJteDRSR0NBK0F5dTNmOGRFT25nd0kK8e0LGq2y0qdyAZr5V798I/4ry9nHFs1H
            SB0oqY7MA/bBQLCkvZ6mfnII6khxWpxcG7VWKbvB3X2YNOAK2s2x0g==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2022-11-09T21:59:37Z"
    mac: ENC[AES256_GCM,data:OyQSfa1hb2iAHLgtgT1N1xlPPUPGlv0pm+NW4kY2rYdHpErwHpSHyowG5lzBF8BJ40OyOhFh8HfR4n+PH38u0kUhz0o/GKYODfMhkfm2jsrc+s38vD3AWr8jegofTypSU+ZxV0N/ipzzJEEPG5Pda3ba02ryAoNBZNf0g3pwoKQ=,iv:7gi12zSf/90yFz7wSWIEV0icI2GQaF89vp91zCHnznU=,tag:q47VTYulcmtO/5IHAZxQAA==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.7.3