Difference between revisions of "Sops --encrypt --gcp-kms"

Latest revision as of 09:12, 24 November 2022

You can define your key using --gcp-kms option or by defining a SOPS_GCP_KMS_IDS environment variable

Exporting your key:

export SOPS_GCP_KMS="projects/your-project/locations/global/keyRings/your-keyring/cryptoKeys/your-sops-encryption-key"

sops --encrypt --gcp-kms $KMS_PATH secret.yaml > secret.enc.yaml

sops --encrypt --gcp-kms $KMS_PATH --in-place your-secret.yaml
(no output)

sops --encrypt --in-place --unencrypted-regex '^(description|metadata)$' k8s-secret.yaml
(no output)

sops --encrypt --in-place --encrypted-regex '^(data|stringData)$' app-secret.yaml
(no output)

sops --encrypt --in-place --encrypted-regex '^(secrets)$' your-secrets_dev.yaml
(no output)

sops --encrypt --gcp-kms only-one-file
Error: no file specified

Failed to get the data key required to decrypt the SOPS file.

@@ Line 1: / Line 1: @@
 {{lc}}
+<code>[[sops --encrypt]] [[--gcp-kms]]</code>
-You can define your key using <code>--gcp-kms</code> option or by defining a <code>[[SOPS_GCP_KMS]]</code> [[environment variable]]
+You can define your key using <code>--gcp-kms</code> option or by defining a <code>[[SOPS_GCP_KMS_IDS]]</code> [[environment variable]]
- [[sops --encrypt]] --gcp-kms
+Exporting your key:
+* <code>export [[SOPS_GCP_KMS]]="projects/your-project/locations/global/keyRings/your-keyring/cryptoKeys/your-sops-encryption-key"</code>
+== Examples ==
   [[sops --encrypt --gcp-kms]] $[[KMS_PATH]] secret.yaml > secret.enc.yaml
- [[sops --encrypt]]
+ [[sops --encrypt --gcp-kms]] $[[KMS_PATH]] --in-place your-secret.yaml
+ (no output)
+ sops --encrypt --in-place [[--unencrypted-regex]] '^(description|metadata)$' k8s-secret.yaml
+ (no output)
+ sops --encrypt --in-place [[--encrypted-regex]] '^(data|stringData)$' app-secret.yaml
+ (no output)
+ [[sops --encrypt --in-place]] --encrypted-regex '^(secrets)$' your-secrets_dev.yaml
+ (no output)
+== Errors ==
   sops --encrypt --gcp-kms only-one-file
   [[Error: no file specified]]
+ [[Failed to get the data key required to decrypt the SOPS file.]]
 == Related ==