SOPS GCP KMS

Encryption/Decryption

To create file:

• sops --gcp /your/path/to/your/sops-encryption-key test.yaml

To encrypt:

• sops --encrypt test.yaml > test.enc.yaml
• sops --encrypt --in-place
• sops --encrypt --gcp-kms

Manage Keys

• gcloud kms keyrings create your-sops-keyring --location global
• gcloud kms keys create --location global --keyring your-sops-keyring --purpose encryption --protection-level "hsm"

--gcp-kms
SOPS_GCP_KMS_IDS

Related

• sops --azure-kv
• SOPS_GCP_KMS_IDS environmental variable

See also

• SOPS, sops | sops -d | sops -e | sops exec-env | sops exec-file | sops publish | sops keyservice | sops groups | sops updatekeys | sops --help
• SOPS: Secrets OPerationS, sops, GCP, ENC[AES256_GCM, sops-secrets-operator

https://github.com/mozilla/sops#26adding-and-removing-keys