sops --encrypt --gcp-kms

You can define your key using --gcp-kms option or by defining a SOPS_GCP_KMS_IDS environment variable

Exporting your key:

export SOPS_GCP_KMS="projects/your-project/locations/global/keyRings/your-keyring/cryptoKeys/your-sops-encryption-key"

Examples

sops --encrypt --gcp-kms $KMS_PATH secret.yaml > secret.enc.yaml

sops --encrypt --gcp-kms $KMS_PATH --in-place your-secret.yaml
(no output)

sops --encrypt --in-place --unencrypted-regex '^(description|metadata)$' k8s-secret.yaml
(no output)

sops --encrypt --in-place --encrypted-regex '^(data|stringData)$' app-secret.yaml
(no output)

sops --encrypt --in-place --encrypted-regex '^(secrets)$' your-secrets_dev.yaml
(no output)

sops --encrypt --gcp-kms only-one-file
Error: no file specified

Failed to get the data key required to decrypt the SOPS file.