Skip to content

Commit e2670d0

Browse files
sabre1041sabre1041
authored
Merge pull request #2001 from enbiyagoral/feat/huaweicloud-kms
feat(hckms): Add HuaweiCloud KMS support
2 parents b3ee47e + ab5a015 commit e2670d0

File tree

13 files changed

+1134
-119
lines changed

13 files changed

+1134
-119
lines changed

‎README.rst‎

Lines changed: 98 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ SOPS: Secrets OPerationS
22
========================
33

44
**SOPS** is an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY
5-
formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, age, and PGP.
5+
formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, and PGP.
66
(`demo <https://www.youtube.com/watch?v=YTEVyLXFiq0>`_)
77

88
.. image:: https://i.imgur.com/X0TM5NI.gif
@@ -532,13 +532,77 @@ To easily deploy Vault locally: (DO NOT DO THIS FOR PRODUCTION!!!)
532532
533533
$ sops encrypt --verbose prod/raw.yaml > prod/encrypted.yaml
534534
535+
Encrypting using HuaweiCloud KMS
536+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
537+
538+
The HuaweiCloud KMS integration uses the
539+
`default credential provider chain <https://github.com/huaweicloud/huaweicloud-sdk-go-v3/blob/master/core/auth/provider/provider.go>`_
540+
which tries several authentication methods, in this order:
541+
542+
1. Environment variables: ``HUAWEICLOUD_SDK_AK``, ``HUAWEICLOUD_SDK_SK``, ``HUAWEICLOUD_SDK_PROJECT_ID``
543+
2. Credentials file at ``~/.huaweicloud/credentials``
544+
3. Instance metadata (when running on HuaweiCloud instances)
545+
546+
For example, you can use environment variables:
547+
548+
.. code:: bash
549+
550+
export HUAWEICLOUD_SDK_AK="your-access-key"
551+
export HUAWEICLOUD_SDK_SK="your-secret-key"
552+
export HUAWEICLOUD_SDK_PROJECT_ID="your-project-id"
553+
554+
Alternatively, you can create a credentials file at ``~/.huaweicloud/credentials``:
555+
556+
.. code:: sh
557+
558+
$ cat ~/.huaweicloud/credentials
559+
[default]
560+
ak = your-access-key
561+
sk = your-secret-key
562+
project_id = your-project-id
563+
564+
Encrypting/decrypting with HuaweiCloud KMS requires a KMS key ID in the format
565+
``region:key-uuid``. You can get the key ID from the HuaweiCloud console or using
566+
the HuaweiCloud API. The key ID format is ``region:key-uuid`` where:
567+
568+
- ``region`` is the HuaweiCloud region (e.g., ``tr-west-1``, ``cn-north-1``)
569+
- ``key-uuid`` is the UUID of the KMS key (e.g., ``abc12345-6789-0123-4567-890123456789``)
570+
571+
Now you can encrypt a file using:
572+
573+
.. code:: sh
574+
575+
$ sops encrypt --hckms tr-west-1:abc12345-6789-0123-4567-890123456789 test.yaml > test.enc.yaml
576+
577+
Or using the environment variable:
578+
579+
.. code:: sh
580+
581+
$ export SOPS_HUAWEICLOUD_KMS_IDS="tr-west-1:abc12345-6789-0123-4567-890123456789"
582+
$ sops encrypt test.yaml > test.enc.yaml
583+
584+
And decrypt it using:
585+
586+
.. code:: sh
587+
588+
$ sops decrypt test.enc.yaml
589+
590+
You can also configure HuaweiCloud KMS keys in the ``.sops.yaml`` config file:
591+
592+
.. code:: yaml
593+
594+
creation_rules:
595+
- path_regex: \.hckms\.yaml$
596+
hckms:
597+
- tr-west-1:abc12345-6789-0123-4567-890123456789,tr-west-2:def67890-1234-5678-9012-345678901234
598+
535599
Adding and removing keys
536600
~~~~~~~~~~~~~~~~~~~~~~~~
537601
538602
When creating new files, ``sops`` uses the PGP, KMS and GCP KMS defined in the
539-
command line arguments ``--kms``, ``--pgp``, ``--gcp-kms`` or ``--azure-kv``, or from
603+
command line arguments ``--kms``, ``--pgp``, ``--gcp-kms``, ``--hckms`` or ``--azure-kv``, or from
540604
the environment variables ``SOPS_KMS_ARN``, ``SOPS_PGP_FP``, ``SOPS_GCP_KMS_IDS``,
541-
``SOPS_AZURE_KEYVAULT_URLS``. That information is stored in the file under the
605+
``SOPS_HUAWEICLOUD_KMS_IDS``, ``SOPS_AZURE_KEYVAULT_URLS``. That information is stored in the file under the
542606
``sops`` section, such that decrypting files does not require providing those
543607
parameters again.
544608
@@ -582,9 +646,9 @@ disabled by supplying the ``-y`` flag.
582646
583647
The ``rotate`` command generates a new data encryption key and reencrypt all values
584648
with the new key. At the same time, the command line flag ``--add-kms``, ``--add-pgp``,
585-
``--add-gcp-kms``, ``--add-azure-kv``, ``--rm-kms``, ``--rm-pgp``, ``--rm-gcp-kms``
586-
and ``--rm-azure-kv`` can be used to add and remove keys from a file. These flags use
587-
the comma separated syntax as the ``--kms``, ``--pgp``, ``--gcp-kms`` and ``--azure-kv``
649+
``--add-gcp-kms``, ``--add-hckms``, ``--add-azure-kv``, ``--rm-kms``, ``--rm-pgp``, ``--rm-gcp-kms``,
650+
``--rm-hckms`` and ``--rm-azure-kv`` can be used to add and remove keys from a file. These flags use
651+
the comma separated syntax as the ``--kms``, ``--pgp``, ``--gcp-kms``, ``--hckms`` and ``--azure-kv``
588652
arguments when creating new files.
589653
590654
Use ``updatekeys`` if you want to add a key without rotating the data key.
@@ -760,7 +824,7 @@ stdout.
760824
Using .sops.yaml conf to select KMS, PGP and age for new files
761825
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
762826
763-
It is often tedious to specify the ``--kms`` ``--gcp-kms`` ``--pgp`` and ``--age`` parameters for creation
827+
It is often tedious to specify the ``--kms`` ``--gcp-kms`` ``--hckms`` ``--pgp`` and ``--age`` parameters for creation
764828
of all new files. If your secrets are stored under a specific directory, like a
765829
``git`` repository, you can create a ``.sops.yaml`` configuration file at the root
766830
directory to define which keys are used for which filename.
@@ -802,6 +866,10 @@ can manage the three sets of configurations for the three types of files:
802866
- path_regex: \.gcp\.yaml$
803867
gcp_kms: projects/mygcproject/locations/global/keyRings/mykeyring/cryptoKeys/thekey
804868
869+
# hckms files using HuaweiCloud KMS
870+
- path_regex: \.hckms\.yaml$
871+
hckms: tr-west-1:abc12345-6789-0123-4567-890123456789,tr-west-2:def67890-1234-5678-9012-345678901234
872+
805873
# Finally, if the rules above have not matched, this one is a
806874
# catchall that will encrypt the file using KMS set C as well as PGP
807875
# The absence of a path_regex means it will match everything
@@ -1797,6 +1865,16 @@ To directly specify a single key group, you can use the following keys:
17971865
- hc_vault_transit_uri:
17981866
- http://my.vault/v1/sops/keys/secondkey
17991867
1868+
* ``hckms`` (list of strings): list of HuaweiCloud KMS key IDs (format: ``<region>:<key-uuid>``).
1869+
Example:
1870+
1871+
.. code:: yaml
1872+
1873+
creation_rules:
1874+
- hckms:
1875+
- tr-west-1:abc12345-6789-0123-4567-890123456789
1876+
- tr-west-1:def67890-1234-5678-9012-345678901234
1877+
18001878
To specify a list of key groups, you can use the following key:
18011879
18021880
* ``key_groups`` (list of key group objects): a list of key group objects.
@@ -1824,6 +1902,8 @@ To specify a list of key groups, you can use the following key:
18241902
- https://vault.url/keys/key-name/ # key without version, the latest will be used
18251903
hc_vault_transit_uri:
18261904
- http://my.vault/v1/sops/keys/secondkey
1905+
hckms:
1906+
- tr-west-1:abc12345-6789-0123-4567-890123456789
18271907
18281908
merge:
18291909
- pgp:
@@ -1901,6 +1981,17 @@ A key group supports the following keys:
19011981
19021982
* ``hc_vault`` (list of strings): list of HashiCorp Vault transit URIs.
19031983
1984+
* ``hckms`` (list of objects): list of HuaweiCloud KMS key IDs.
1985+
Every object must have the following key:
1986+
1987+
* ``key_id`` (string): the key ID in format ``<region>:<key-uuid>``.
1988+
1989+
Example:
1990+
1991+
.. code:: yaml
1992+
1993+
- key_id: tr-west-1:abc12345-6789-0123-4567-890123456789
1994+
19041995
* ``age`` (list of strings): list of Age public keys.
19051996
19061997
* ``pgp`` (list of strings): list of PGP/GPG key fingerprints.

‎cmd/sops/main.go‎

Lines changed: 73 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ import (
3434
"github.com/getsops/sops/v3/cmd/sops/subcommand/updatekeys"
3535
"github.com/getsops/sops/v3/config"
3636
"github.com/getsops/sops/v3/gcpkms"
37+
"github.com/getsops/sops/v3/hckms"
3738
"github.com/getsops/sops/v3/hcvault"
3839
"github.com/getsops/sops/v3/keys"
3940
"github.com/getsops/sops/v3/keyservice"
@@ -90,13 +91,13 @@ func main() {
9091
},
9192
}
9293
app.Name = "sops"
93-
app.Usage = "sops - encrypted file editor with AWS KMS, GCP KMS, Azure Key Vault, age, and GPG support"
94+
app.Usage = "sops - encrypted file editor with AWS KMS, GCP KMS, HuaweiCloud KMS, Azure Key Vault, age, and GPG support"
9495
app.ArgsUsage = "sops [options] file"
9596
app.Version = version.Version
9697
app.Authors = []cli.Author{
9798
{Name: "CNCF Maintainers"},
9899
}
99-
app.UsageText = `sops is an editor of encrypted files that supports AWS KMS, GCP, AZKV,
100+
app.UsageText = `sops is an editor of encrypted files that supports AWS KMS, GCP, HuaweiCloud KMS, AZKV,
100101
PGP, and Age
101102
102103
To encrypt or decrypt a document with AWS KMS, specify the KMS ARN
@@ -109,6 +110,12 @@ func main() {
109110
(You need to setup Google application default credentials. See
110111
https://developers.google.com/identity/protocols/application-default-credentials)
111112
113+
To encrypt or decrypt a document with HuaweiCloud KMS, specify the
114+
HuaweiCloud KMS key ID (format: region:key-uuid) in the --hckms flag or in the
115+
SOPS_HUAWEICLOUD_KMS_IDS environment variable.
116+
(You need to setup HuaweiCloud credentials via environment variables:
117+
HUAWEICLOUD_SDK_AK, HUAWEICLOUD_SDK_SK, HUAWEICLOUD_SDK_PROJECT_ID, or
118+
use credentials file at ~/.huaweicloud/credentials)
112119
113120
To encrypt or decrypt a document with HashiCorp Vault's Transit Secret
114121
Engine, specify the Vault key URI name in the --hc-vault-transit flag
@@ -135,12 +142,12 @@ func main() {
135142
To use multiple KMS or PGP keys, separate them by commas. For example:
136143
$ sops -p "10F2...0A, 85D...B3F21" file.yaml
137144
138-
The -p, -k, --gcp-kms, --hc-vault-transit, and --azure-kv flags are only
145+
The -p, -k, --gcp-kms, --hckms, --hc-vault-transit, and --azure-kv flags are only
139146
used to encrypt new documents. Editing or decrypting existing documents
140147
can be done with "sops file" or "sops decrypt file" respectively. The KMS and
141148
PGP keys listed in the encrypted documents are used then. To manage master
142-
keys in existing documents, use the "add-{kms,pgp,gcp-kms,azure-kv,hc-vault-transit}"
143-
and "rm-{kms,pgp,gcp-kms,azure-kv,hc-vault-transit}" flags with --rotate
149+
keys in existing documents, use the "add-{kms,pgp,gcp-kms,hckms,azure-kv,hc-vault-transit}"
150+
and "rm-{kms,pgp,gcp-kms,hckms,azure-kv,hc-vault-transit}" flags with --rotate
144151
or the updatekeys command.
145152
146153
To use a different GPG binary than the one in your PATH, set SOPS_GPG_EXEC.
@@ -570,6 +577,10 @@ func main() {
570577
Name: "gcp-kms",
571578
Usage: "the GCP KMS Resource ID the new group should contain. Can be specified more than once",
572579
},
580+
cli.StringSliceFlag{
581+
Name: "hckms",
582+
Usage: "the HuaweiCloud KMS key ID (format: region:key-uuid) the new group should contain. Can be specified more than once",
583+
},
573584
cli.StringSliceFlag{
574585
Name: "azure-kv",
575586
Usage: "the Azure Key Vault key URL the new group should contain. Can be specified more than once",
@@ -933,6 +944,11 @@ func main() {
933944
Usage: "comma separated list of GCP KMS resource IDs",
934945
EnvVar: "SOPS_GCP_KMS_IDS",
935946
},
947+
cli.StringFlag{
948+
Name: "hckms",
949+
Usage: "comma separated list of HuaweiCloud KMS key IDs (format: region:key-uuid)",
950+
EnvVar: "SOPS_HUAWEICLOUD_KMS_IDS",
951+
},
936952
cli.StringFlag{
937953
Name: "azure-kv",
938954
Usage: "comma separated list of Azure Key Vault URLs",
@@ -1118,6 +1134,14 @@ func main() {
11181134
Name: "rm-gcp-kms",
11191135
Usage: "remove the provided comma-separated list of GCP KMS key resource IDs from the list of master keys on the given file",
11201136
},
1137+
cli.StringFlag{
1138+
Name: "add-hckms",
1139+
Usage: "add the provided comma-separated list of HuaweiCloud KMS key IDs (format: region:key-uuid) to the list of master keys on the given file",
1140+
},
1141+
cli.StringFlag{
1142+
Name: "rm-hckms",
1143+
Usage: "remove the provided comma-separated list of HuaweiCloud KMS key IDs (format: region:key-uuid) from the list of master keys on the given file",
1144+
},
11211145
cli.StringFlag{
11221146
Name: "add-azure-kv",
11231147
Usage: "add the provided comma-separated list of Azure Key Vault key URLs to the list of master keys on the given file",
@@ -1184,8 +1208,8 @@ func main() {
11841208
return toExitError(err)
11851209
}
11861210
if _, err := os.Stat(fileName); os.IsNotExist(err) {
1187-
if c.String("add-kms") != "" || c.String("add-pgp") != "" || c.String("add-gcp-kms") != "" || c.String("add-hc-vault-transit") != "" || c.String("add-azure-kv") != "" || c.String("add-age") != "" ||
1188-
c.String("rm-kms") != "" || c.String("rm-pgp") != "" || c.String("rm-gcp-kms") != "" || c.String("rm-hc-vault-transit") != "" || c.String("rm-azure-kv") != "" || c.String("rm-age") != "" {
1211+
if c.String("add-kms") != "" || c.String("add-pgp") != "" || c.String("add-gcp-kms") != "" || c.String("add-hckms") != "" || c.String("add-hc-vault-transit") != "" || c.String("add-azure-kv") != "" || c.String("add-age") != "" ||
1212+
c.String("rm-kms") != "" || c.String("rm-pgp") != "" || c.String("rm-gcp-kms") != "" || c.String("rm-hckms") != "" || c.String("rm-hc-vault-transit") != "" || c.String("rm-azure-kv") != "" || c.String("rm-age") != "" {
11891213
return common.NewExitError(fmt.Sprintf("Error: cannot add or remove keys on non-existent file %q, use the `edit` subcommand instead.", fileName), codes.CannotChangeKeysFromNonExistentFile)
11901214
}
11911215
}
@@ -1271,6 +1295,11 @@ func main() {
12711295
Usage: "comma separated list of GCP KMS resource IDs",
12721296
EnvVar: "SOPS_GCP_KMS_IDS",
12731297
},
1298+
cli.StringFlag{
1299+
Name: "hckms",
1300+
Usage: "comma separated list of HuaweiCloud KMS key IDs (format: region:key-uuid)",
1301+
EnvVar: "SOPS_HUAWEICLOUD_KMS_IDS",
1302+
},
12741303
cli.StringFlag{
12751304
Name: "azure-kv",
12761305
Usage: "comma separated list of Azure Key Vault URLs",
@@ -1679,6 +1708,11 @@ func main() {
16791708
Usage: "comma separated list of GCP KMS resource IDs",
16801709
EnvVar: "SOPS_GCP_KMS_IDS",
16811710
},
1711+
cli.StringFlag{
1712+
Name: "hckms",
1713+
Usage: "comma separated list of HuaweiCloud KMS key IDs (format: region:key-uuid)",
1714+
EnvVar: "SOPS_HUAWEICLOUD_KMS_IDS",
1715+
},
16821716
cli.StringFlag{
16831717
Name: "azure-kv",
16841718
Usage: "comma separated list of Azure Key Vault URLs",
@@ -1727,6 +1761,14 @@ func main() {
17271761
Name: "rm-gcp-kms",
17281762
Usage: "remove the provided comma-separated list of GCP KMS key resource IDs from the list of master keys on the given file",
17291763
},
1764+
cli.StringFlag{
1765+
Name: "add-hckms",
1766+
Usage: "add the provided comma-separated list of HuaweiCloud KMS key IDs (format: region:key-uuid) to the list of master keys on the given file",
1767+
},
1768+
cli.StringFlag{
1769+
Name: "rm-hckms",
1770+
Usage: "remove the provided comma-separated list of HuaweiCloud KMS key IDs (format: region:key-uuid) from the list of master keys on the given file",
1771+
},
17301772
cli.StringFlag{
17311773
Name: "add-azure-kv",
17321774
Usage: "add the provided comma-separated list of Azure Key Vault key URLs to the list of master keys on the given file",
@@ -1861,8 +1903,8 @@ func main() {
18611903
return toExitError(err)
18621904
}
18631905
if _, err := os.Stat(fileName); os.IsNotExist(err) {
1864-
if c.String("add-kms") != "" || c.String("add-pgp") != "" || c.String("add-gcp-kms") != "" || c.String("add-hc-vault-transit") != "" || c.String("add-azure-kv") != "" || c.String("add-age") != "" ||
1865-
c.String("rm-kms") != "" || c.String("rm-pgp") != "" || c.String("rm-gcp-kms") != "" || c.String("rm-hc-vault-transit") != "" || c.String("rm-azure-kv") != "" || c.String("rm-age") != "" {
1906+
if c.String("add-kms") != "" || c.String("add-pgp") != "" || c.String("add-gcp-kms") != "" || c.String("add-hckms") != "" || c.String("add-hc-vault-transit") != "" || c.String("add-azure-kv") != "" || c.String("add-age") != "" ||
1907+
c.String("rm-kms") != "" || c.String("rm-pgp") != "" || c.String("rm-gcp-kms") != "" || c.String("rm-hckms") != "" || c.String("rm-hc-vault-transit") != "" || c.String("rm-azure-kv") != "" || c.String("rm-age") != "" {
18661908
return common.NewExitError(fmt.Sprintf("Error: cannot add or remove keys on non-existent file %q, use `--kms` and `--pgp` instead.", fileName), codes.CannotChangeKeysFromNonExistentFile)
18671909
}
18681910
if isEncryptMode || isDecryptMode || isRotateMode {
@@ -2192,7 +2234,7 @@ func getEncryptConfig(c *cli.Context, fileName string, inputStore common.Store,
21922234
}, nil
21932235
}
21942236

2195-
func getMasterKeys(c *cli.Context, kmsEncryptionContext map[string]*string, kmsOptionName string, pgpOptionName string, gcpKmsOptionName string, azureKvOptionName string, hcVaultTransitOptionName string, ageOptionName string) ([]keys.MasterKey, error) {
2237+
func getMasterKeys(c *cli.Context, kmsEncryptionContext map[string]*string, kmsOptionName string, pgpOptionName string, gcpKmsOptionName string, hckmsOptionName string, azureKvOptionName string, hcVaultTransitOptionName string, ageOptionName string) ([]keys.MasterKey, error) {
21962238
var masterKeys []keys.MasterKey
21972239
for _, k := range kms.MasterKeysFromArnString(c.String(kmsOptionName), kmsEncryptionContext, c.String("aws-profile")) {
21982240
masterKeys = append(masterKeys, k)
@@ -2203,6 +2245,13 @@ func getMasterKeys(c *cli.Context, kmsEncryptionContext map[string]*string, kmsO
22032245
for _, k := range gcpkms.MasterKeysFromResourceIDString(c.String(gcpKmsOptionName)) {
22042246
masterKeys = append(masterKeys, k)
22052247
}
2248+
hckmsKeys, err := hckms.NewMasterKeyFromKeyIDString(c.String(hckmsOptionName))
2249+
if err != nil {
2250+
return nil, err
2251+
}
2252+
for _, k := range hckmsKeys {
2253+
masterKeys = append(masterKeys, k)
2254+
}
22062255
azureKeys, err := azkv.MasterKeysFromURLs(c.String(azureKvOptionName))
22072256
if err != nil {
22082257
return nil, err
@@ -2229,11 +2278,11 @@ func getMasterKeys(c *cli.Context, kmsEncryptionContext map[string]*string, kmsO
22292278

22302279
func getRotateOpts(c *cli.Context, fileName string, inputStore common.Store, outputStore common.Store, svcs []keyservice.KeyServiceClient, decryptionOrder []string) (rotateOpts, error) {
22312280
kmsEncryptionContext := kms.ParseKMSContext(c.String("encryption-context"))
2232-
addMasterKeys, err := getMasterKeys(c, kmsEncryptionContext, "add-kms", "add-pgp", "add-gcp-kms", "add-azure-kv", "add-hc-vault-transit", "add-age")
2281+
addMasterKeys, err := getMasterKeys(c, kmsEncryptionContext, "add-kms", "add-pgp", "add-gcp-kms", "add-hckms", "add-azure-kv", "add-hc-vault-transit", "add-age")
22332282
if err != nil {
22342283
return rotateOpts{}, err
22352284
}
2236-
rmMasterKeys, err := getMasterKeys(c, kmsEncryptionContext, "rm-kms", "rm-pgp", "rm-gcp-kms", "rm-azure-kv", "rm-hc-vault-transit", "rm-age")
2285+
rmMasterKeys, err := getMasterKeys(c, kmsEncryptionContext, "rm-kms", "rm-pgp", "rm-gcp-kms", "rm-hckms", "rm-azure-kv", "rm-hc-vault-transit", "rm-age")
22372286
if err != nil {
22382287
return rotateOpts{}, err
22392288
}
@@ -2381,6 +2430,7 @@ func keyGroups(c *cli.Context, file string, optionalConfig *config.Config) ([]so
23812430
var cloudKmsKeys []keys.MasterKey
23822431
var azkvKeys []keys.MasterKey
23832432
var hcVaultMkKeys []keys.MasterKey
2433+
var hckmsMkKeys []keys.MasterKey
23842434
var ageMasterKeys []keys.MasterKey
23852435
kmsEncryptionContext := kms.ParseKMSContext(c.String("encryption-context"))
23862436
if c.String("encryption-context") != "" && kmsEncryptionContext == nil {
@@ -2396,6 +2446,15 @@ func keyGroups(c *cli.Context, file string, optionalConfig *config.Config) ([]so
23962446
cloudKmsKeys = append(cloudKmsKeys, k)
23972447
}
23982448
}
2449+
if c.String("hckms") != "" {
2450+
hckmsKeys, err := hckms.NewMasterKeyFromKeyIDString(c.String("hckms"))
2451+
if err != nil {
2452+
return nil, err
2453+
}
2454+
for _, k := range hckmsKeys {
2455+
hckmsMkKeys = append(hckmsMkKeys, k)
2456+
}
2457+
}
23992458
if c.String("azure-kv") != "" {
24002459
azureKeys, err := azkv.MasterKeysFromURLs(c.String("azure-kv"))
24012460
if err != nil {
@@ -2428,7 +2487,7 @@ func keyGroups(c *cli.Context, file string, optionalConfig *config.Config) ([]so
24282487
ageMasterKeys = append(ageMasterKeys, k)
24292488
}
24302489
}
2431-
if c.String("kms") == "" && c.String("pgp") == "" && c.String("gcp-kms") == "" && c.String("azure-kv") == "" && c.String("hc-vault-transit") == "" && c.String("age") == "" {
2490+
if c.String("kms") == "" && c.String("pgp") == "" && c.String("gcp-kms") == "" && c.String("hckms") == "" && c.String("azure-kv") == "" && c.String("hc-vault-transit") == "" && c.String("age") == "" {
24322491
conf := optionalConfig
24332492
var err error
24342493
if conf == nil {
@@ -2447,6 +2506,7 @@ func keyGroups(c *cli.Context, file string, optionalConfig *config.Config) ([]so
24472506
var group sops.KeyGroup
24482507
group = append(group, kmsKeys...)
24492508
group = append(group, cloudKmsKeys...)
2509+
group = append(group, hckmsMkKeys...)
24502510
group = append(group, azkvKeys...)
24512511
group = append(group, pgpKeys...)
24522512
group = append(group, hcVaultMkKeys...)

0 commit comments

Comments
 (0)