Sops --encrypt --gcp-kms

sops --encrypt --gcp-kms

You can define your key using --gcp-kms option or by defining a SOPS_GCP_KMS_IDS environment variable

Exporting your key:

• export SOPS_GCP_KMS="projects/your-project/locations/global/keyRings/your-keyring/cryptoKeys/your-sops-encryption-key"

Examples

sops --encrypt --gcp-kms $KMS_PATH secret.yaml > secret.enc.yaml

sops --encrypt --gcp-kms $KMS_PATH --in-place your-secret.yaml
(no output)

sops --encrypt --in-place --unencrypted-regex '^(description|metadata)$' k8s-secret.yaml
(no output)

sops --encrypt --in-place --encrypted-regex '^(data|stringData)$' app-secret.yaml
(no output)

sops --encrypt --in-place --encrypted-regex '^(secrets)$' your-secrets_dev.yaml
(no output)

Errors

sops --encrypt --gcp-kms only-one-file
Error: no file specified

Failed to get the data key required to decrypt the SOPS file.

Related

• sops --decrypt --gcp-kms
• gcloud kms keys list --location global --keyring sops
• SOPS_GCP_KMS environment variable
• KMS

See also

• SOPS, sops | sops -d | sops -e | sops exec-env | sops exec-file | sops publish | sops keyservice | sops groups | sops updatekeys | sops --help
• SOPS: Secrets OPerationS, sops, GCP, ENC[AES256_GCM, sops-secrets-operator