Difference between revisions of "Sops --encrypt --gcp-kms"

Latest revision as of 09:12, 24 November 2022

You can define your key using --gcp-kms option or by defining a SOPS_GCP_KMS_IDS environment variable

Exporting your key:

export SOPS_GCP_KMS="projects/your-project/locations/global/keyRings/your-keyring/cryptoKeys/your-sops-encryption-key"

sops --encrypt --gcp-kms $KMS_PATH secret.yaml > secret.enc.yaml

sops --encrypt --gcp-kms $KMS_PATH --in-place your-secret.yaml
(no output)

sops --encrypt --in-place --unencrypted-regex '^(description|metadata)$' k8s-secret.yaml
(no output)

sops --encrypt --in-place --encrypted-regex '^(data|stringData)$' app-secret.yaml
(no output)

sops --encrypt --in-place --encrypted-regex '^(secrets)$' your-secrets_dev.yaml
(no output)

sops --encrypt --gcp-kms only-one-file
Error: no file specified

Failed to get the data key required to decrypt the SOPS file.

@@ Line 2: / Line 2: @@
 <code>[[sops --encrypt]] [[--gcp-kms]]</code>
-You can define your key using <code>--gcp-kms</code> option or by defining a <code>[[SOPS_GCP_KMS]]</code> [[environment variable]]
+You can define your key using <code>--gcp-kms</code> option or by defining a <code>[[SOPS_GCP_KMS_IDS]]</code> [[environment variable]]
 Exporting your key:
@@ Line 16: / Line 16: @@
   (no output)
-  sops --encrypt [[--encrypted-regex]] '^(data|stringData)$' app-secret.yaml
+  sops --encrypt --in-place [[--encrypted-regex]] '^(data|stringData)$' app-secret.yaml
+ (no output)
+ [[sops --encrypt --in-place]] --encrypted-regex '^(secrets)$' your-secrets_dev.yaml
   (no output)
@@ Line 22: / Line 25: @@
   sops --encrypt --gcp-kms only-one-file
   [[Error: no file specified]]
+ [[Failed to get the data key required to decrypt the SOPS file.]]
 == Related ==