@@ -34,6 +34,7 @@ import (
3434 "github.com/getsops/sops/v3/cmd/sops/subcommand/updatekeys"
3535 "github.com/getsops/sops/v3/config"
3636 "github.com/getsops/sops/v3/gcpkms"
37+ "github.com/getsops/sops/v3/hckms"
3738 "github.com/getsops/sops/v3/hcvault"
3839 "github.com/getsops/sops/v3/keys"
3940 "github.com/getsops/sops/v3/keyservice"
@@ -90,13 +91,13 @@ func main() {
9091 },
9192 }
9293 app .Name = "sops"
93- app .Usage = "sops - encrypted file editor with AWS KMS, GCP KMS, Azure Key Vault, age, and GPG support"
94+ app .Usage = "sops - encrypted file editor with AWS KMS, GCP KMS, HuaweiCloud KMS, Azure Key Vault, age, and GPG support"
9495 app .ArgsUsage = "sops [options] file"
9596 app .Version = version .Version
9697 app .Authors = []cli.Author {
9798 {Name : "CNCF Maintainers" },
9899 }
99- app .UsageText = `sops is an editor of encrypted files that supports AWS KMS, GCP, AZKV,
100+ app .UsageText = `sops is an editor of encrypted files that supports AWS KMS, GCP, HuaweiCloud KMS, AZKV,
100101 PGP, and Age
101102
102103 To encrypt or decrypt a document with AWS KMS, specify the KMS ARN
@@ -109,6 +110,12 @@ func main() {
109110 (You need to setup Google application default credentials. See
110111 https://developers.google.com/identity/protocols/application-default-credentials)
111112
113+ To encrypt or decrypt a document with HuaweiCloud KMS, specify the
114+ HuaweiCloud KMS key ID (format: region:key-uuid) in the --hckms flag or in the
115+ SOPS_HUAWEICLOUD_KMS_IDS environment variable.
116+ (You need to setup HuaweiCloud credentials via environment variables:
117+ HUAWEICLOUD_SDK_AK, HUAWEICLOUD_SDK_SK, HUAWEICLOUD_SDK_PROJECT_ID, or
118+ use credentials file at ~/.huaweicloud/credentials)
112119
113120 To encrypt or decrypt a document with HashiCorp Vault's Transit Secret
114121 Engine, specify the Vault key URI name in the --hc-vault-transit flag
@@ -135,12 +142,12 @@ func main() {
135142 To use multiple KMS or PGP keys, separate them by commas. For example:
136143 $ sops -p "10F2...0A, 85D...B3F21" file.yaml
137144
138- The -p, -k, --gcp-kms, --hc-vault-transit, and --azure-kv flags are only
145+ The -p, -k, --gcp-kms, --hckms, -- hc-vault-transit, and --azure-kv flags are only
139146 used to encrypt new documents. Editing or decrypting existing documents
140147 can be done with "sops file" or "sops decrypt file" respectively. The KMS and
141148 PGP keys listed in the encrypted documents are used then. To manage master
142- keys in existing documents, use the "add-{kms,pgp,gcp-kms,azure-kv,hc-vault-transit}"
143- and "rm-{kms,pgp,gcp-kms,azure-kv,hc-vault-transit}" flags with --rotate
149+ keys in existing documents, use the "add-{kms,pgp,gcp-kms,hckms, azure-kv,hc-vault-transit}"
150+ and "rm-{kms,pgp,gcp-kms,hckms, azure-kv,hc-vault-transit}" flags with --rotate
144151 or the updatekeys command.
145152
146153 To use a different GPG binary than the one in your PATH, set SOPS_GPG_EXEC.
@@ -570,6 +577,10 @@ func main() {
570577 Name : "gcp-kms" ,
571578 Usage : "the GCP KMS Resource ID the new group should contain. Can be specified more than once" ,
572579 },
580+ cli.StringSliceFlag {
581+ Name : "hckms" ,
582+ Usage : "the HuaweiCloud KMS key ID (format: region:key-uuid) the new group should contain. Can be specified more than once" ,
583+ },
573584 cli.StringSliceFlag {
574585 Name : "azure-kv" ,
575586 Usage : "the Azure Key Vault key URL the new group should contain. Can be specified more than once" ,
@@ -933,6 +944,11 @@ func main() {
933944 Usage : "comma separated list of GCP KMS resource IDs" ,
934945 EnvVar : "SOPS_GCP_KMS_IDS" ,
935946 },
947+ cli.StringFlag {
948+ Name : "hckms" ,
949+ Usage : "comma separated list of HuaweiCloud KMS key IDs (format: region:key-uuid)" ,
950+ EnvVar : "SOPS_HUAWEICLOUD_KMS_IDS" ,
951+ },
936952 cli.StringFlag {
937953 Name : "azure-kv" ,
938954 Usage : "comma separated list of Azure Key Vault URLs" ,
@@ -1118,6 +1134,14 @@ func main() {
11181134 Name : "rm-gcp-kms" ,
11191135 Usage : "remove the provided comma-separated list of GCP KMS key resource IDs from the list of master keys on the given file" ,
11201136 },
1137+ cli.StringFlag {
1138+ Name : "add-hckms" ,
1139+ Usage : "add the provided comma-separated list of HuaweiCloud KMS key IDs (format: region:key-uuid) to the list of master keys on the given file" ,
1140+ },
1141+ cli.StringFlag {
1142+ Name : "rm-hckms" ,
1143+ Usage : "remove the provided comma-separated list of HuaweiCloud KMS key IDs (format: region:key-uuid) from the list of master keys on the given file" ,
1144+ },
11211145 cli.StringFlag {
11221146 Name : "add-azure-kv" ,
11231147 Usage : "add the provided comma-separated list of Azure Key Vault key URLs to the list of master keys on the given file" ,
@@ -1184,8 +1208,8 @@ func main() {
11841208 return toExitError (err )
11851209 }
11861210 if _ , err := os .Stat (fileName ); os .IsNotExist (err ) {
1187- if c .String ("add-kms" ) != "" || c .String ("add-pgp" ) != "" || c .String ("add-gcp-kms" ) != "" || c .String ("add-hc-vault-transit" ) != "" || c .String ("add-azure-kv" ) != "" || c .String ("add-age" ) != "" ||
1188- c .String ("rm-kms" ) != "" || c .String ("rm-pgp" ) != "" || c .String ("rm-gcp-kms" ) != "" || c .String ("rm-hc-vault-transit" ) != "" || c .String ("rm-azure-kv" ) != "" || c .String ("rm-age" ) != "" {
1211+ if c .String ("add-kms" ) != "" || c .String ("add-pgp" ) != "" || c .String ("add-gcp-kms" ) != "" || c .String ("add-hckms" ) != "" || c . String ( "add- hc-vault-transit" ) != "" || c .String ("add-azure-kv" ) != "" || c .String ("add-age" ) != "" ||
1212+ c .String ("rm-kms" ) != "" || c .String ("rm-pgp" ) != "" || c .String ("rm-gcp-kms" ) != "" || c .String ("rm-hckms" ) != "" || c . String ( "rm- hc-vault-transit" ) != "" || c .String ("rm-azure-kv" ) != "" || c .String ("rm-age" ) != "" {
11891213 return common .NewExitError (fmt .Sprintf ("Error: cannot add or remove keys on non-existent file %q, use the `edit` subcommand instead." , fileName ), codes .CannotChangeKeysFromNonExistentFile )
11901214 }
11911215 }
@@ -1271,6 +1295,11 @@ func main() {
12711295 Usage : "comma separated list of GCP KMS resource IDs" ,
12721296 EnvVar : "SOPS_GCP_KMS_IDS" ,
12731297 },
1298+ cli.StringFlag {
1299+ Name : "hckms" ,
1300+ Usage : "comma separated list of HuaweiCloud KMS key IDs (format: region:key-uuid)" ,
1301+ EnvVar : "SOPS_HUAWEICLOUD_KMS_IDS" ,
1302+ },
12741303 cli.StringFlag {
12751304 Name : "azure-kv" ,
12761305 Usage : "comma separated list of Azure Key Vault URLs" ,
@@ -1679,6 +1708,11 @@ func main() {
16791708 Usage : "comma separated list of GCP KMS resource IDs" ,
16801709 EnvVar : "SOPS_GCP_KMS_IDS" ,
16811710 },
1711+ cli.StringFlag {
1712+ Name : "hckms" ,
1713+ Usage : "comma separated list of HuaweiCloud KMS key IDs (format: region:key-uuid)" ,
1714+ EnvVar : "SOPS_HUAWEICLOUD_KMS_IDS" ,
1715+ },
16821716 cli.StringFlag {
16831717 Name : "azure-kv" ,
16841718 Usage : "comma separated list of Azure Key Vault URLs" ,
@@ -1727,6 +1761,14 @@ func main() {
17271761 Name : "rm-gcp-kms" ,
17281762 Usage : "remove the provided comma-separated list of GCP KMS key resource IDs from the list of master keys on the given file" ,
17291763 },
1764+ cli.StringFlag {
1765+ Name : "add-hckms" ,
1766+ Usage : "add the provided comma-separated list of HuaweiCloud KMS key IDs (format: region:key-uuid) to the list of master keys on the given file" ,
1767+ },
1768+ cli.StringFlag {
1769+ Name : "rm-hckms" ,
1770+ Usage : "remove the provided comma-separated list of HuaweiCloud KMS key IDs (format: region:key-uuid) from the list of master keys on the given file" ,
1771+ },
17301772 cli.StringFlag {
17311773 Name : "add-azure-kv" ,
17321774 Usage : "add the provided comma-separated list of Azure Key Vault key URLs to the list of master keys on the given file" ,
@@ -1861,8 +1903,8 @@ func main() {
18611903 return toExitError (err )
18621904 }
18631905 if _ , err := os .Stat (fileName ); os .IsNotExist (err ) {
1864- if c .String ("add-kms" ) != "" || c .String ("add-pgp" ) != "" || c .String ("add-gcp-kms" ) != "" || c .String ("add-hc-vault-transit" ) != "" || c .String ("add-azure-kv" ) != "" || c .String ("add-age" ) != "" ||
1865- c .String ("rm-kms" ) != "" || c .String ("rm-pgp" ) != "" || c .String ("rm-gcp-kms" ) != "" || c .String ("rm-hc-vault-transit" ) != "" || c .String ("rm-azure-kv" ) != "" || c .String ("rm-age" ) != "" {
1906+ if c .String ("add-kms" ) != "" || c .String ("add-pgp" ) != "" || c .String ("add-gcp-kms" ) != "" || c .String ("add-hckms" ) != "" || c . String ( "add- hc-vault-transit" ) != "" || c .String ("add-azure-kv" ) != "" || c .String ("add-age" ) != "" ||
1907+ c .String ("rm-kms" ) != "" || c .String ("rm-pgp" ) != "" || c .String ("rm-gcp-kms" ) != "" || c .String ("rm-hckms" ) != "" || c . String ( "rm- hc-vault-transit" ) != "" || c .String ("rm-azure-kv" ) != "" || c .String ("rm-age" ) != "" {
18661908 return common .NewExitError (fmt .Sprintf ("Error: cannot add or remove keys on non-existent file %q, use `--kms` and `--pgp` instead." , fileName ), codes .CannotChangeKeysFromNonExistentFile )
18671909 }
18681910 if isEncryptMode || isDecryptMode || isRotateMode {
@@ -2191,7 +2233,7 @@ func getEncryptConfig(c *cli.Context, fileName string, inputStore common.Store,
21912233 }, nil
21922234}
21932235
2194- func getMasterKeys (c * cli.Context , kmsEncryptionContext map [string ]* string , kmsOptionName string , pgpOptionName string , gcpKmsOptionName string , azureKvOptionName string , hcVaultTransitOptionName string , ageOptionName string ) ([]keys.MasterKey , error ) {
2236+ func getMasterKeys (c * cli.Context , kmsEncryptionContext map [string ]* string , kmsOptionName string , pgpOptionName string , gcpKmsOptionName string , hckmsOptionName string , azureKvOptionName string , hcVaultTransitOptionName string , ageOptionName string ) ([]keys.MasterKey , error ) {
21952237 var masterKeys []keys.MasterKey
21962238 for _ , k := range kms .MasterKeysFromArnString (c .String (kmsOptionName ), kmsEncryptionContext , c .String ("aws-profile" )) {
21972239 masterKeys = append (masterKeys , k )
@@ -2202,6 +2244,13 @@ func getMasterKeys(c *cli.Context, kmsEncryptionContext map[string]*string, kmsO
22022244 for _ , k := range gcpkms .MasterKeysFromResourceIDString (c .String (gcpKmsOptionName )) {
22032245 masterKeys = append (masterKeys , k )
22042246 }
2247+ hckmsKeys , err := hckms .NewMasterKeyFromKeyIDString (c .String (hckmsOptionName ))
2248+ if err != nil {
2249+ return nil , err
2250+ }
2251+ for _ , k := range hckmsKeys {
2252+ masterKeys = append (masterKeys , k )
2253+ }
22052254 azureKeys , err := azkv .MasterKeysFromURLs (c .String (azureKvOptionName ))
22062255 if err != nil {
22072256 return nil , err
@@ -2228,11 +2277,11 @@ func getMasterKeys(c *cli.Context, kmsEncryptionContext map[string]*string, kmsO
22282277
22292278func getRotateOpts (c * cli.Context , fileName string , inputStore common.Store , outputStore common.Store , svcs []keyservice.KeyServiceClient , decryptionOrder []string ) (rotateOpts , error ) {
22302279 kmsEncryptionContext := kms .ParseKMSContext (c .String ("encryption-context" ))
2231- addMasterKeys , err := getMasterKeys (c , kmsEncryptionContext , "add-kms" , "add-pgp" , "add-gcp-kms" , "add-azure-kv" , "add-hc-vault-transit" , "add-age" )
2280+ addMasterKeys , err := getMasterKeys (c , kmsEncryptionContext , "add-kms" , "add-pgp" , "add-gcp-kms" , "add-hckms" , "add- azure-kv" , "add-hc-vault-transit" , "add-age" )
22322281 if err != nil {
22332282 return rotateOpts {}, err
22342283 }
2235- rmMasterKeys , err := getMasterKeys (c , kmsEncryptionContext , "rm-kms" , "rm-pgp" , "rm-gcp-kms" , "rm-azure-kv" , "rm-hc-vault-transit" , "rm-age" )
2284+ rmMasterKeys , err := getMasterKeys (c , kmsEncryptionContext , "rm-kms" , "rm-pgp" , "rm-gcp-kms" , "rm-hckms" , "rm- azure-kv" , "rm-hc-vault-transit" , "rm-age" )
22362285 if err != nil {
22372286 return rotateOpts {}, err
22382287 }
@@ -2380,6 +2429,7 @@ func keyGroups(c *cli.Context, file string, optionalConfig *config.Config) ([]so
23802429 var cloudKmsKeys []keys.MasterKey
23812430 var azkvKeys []keys.MasterKey
23822431 var hcVaultMkKeys []keys.MasterKey
2432+ var hckmsMkKeys []keys.MasterKey
23832433 var ageMasterKeys []keys.MasterKey
23842434 kmsEncryptionContext := kms .ParseKMSContext (c .String ("encryption-context" ))
23852435 if c .String ("encryption-context" ) != "" && kmsEncryptionContext == nil {
@@ -2395,6 +2445,15 @@ func keyGroups(c *cli.Context, file string, optionalConfig *config.Config) ([]so
23952445 cloudKmsKeys = append (cloudKmsKeys , k )
23962446 }
23972447 }
2448+ if c .String ("hckms" ) != "" {
2449+ hckmsKeys , err := hckms .NewMasterKeyFromKeyIDString (c .String ("hckms" ))
2450+ if err != nil {
2451+ return nil , err
2452+ }
2453+ for _ , k := range hckmsKeys {
2454+ hckmsMkKeys = append (hckmsMkKeys , k )
2455+ }
2456+ }
23982457 if c .String ("azure-kv" ) != "" {
23992458 azureKeys , err := azkv .MasterKeysFromURLs (c .String ("azure-kv" ))
24002459 if err != nil {
@@ -2427,7 +2486,7 @@ func keyGroups(c *cli.Context, file string, optionalConfig *config.Config) ([]so
24272486 ageMasterKeys = append (ageMasterKeys , k )
24282487 }
24292488 }
2430- if c .String ("kms" ) == "" && c .String ("pgp" ) == "" && c .String ("gcp-kms" ) == "" && c .String ("azure-kv" ) == "" && c .String ("hc-vault-transit" ) == "" && c .String ("age" ) == "" {
2489+ if c .String ("kms" ) == "" && c .String ("pgp" ) == "" && c .String ("gcp-kms" ) == "" && c .String ("hckms" ) == "" && c . String ( " azure-kv" ) == "" && c .String ("hc-vault-transit" ) == "" && c .String ("age" ) == "" {
24312490 conf := optionalConfig
24322491 var err error
24332492 if conf == nil {
@@ -2446,6 +2505,7 @@ func keyGroups(c *cli.Context, file string, optionalConfig *config.Config) ([]so
24462505 var group sops.KeyGroup
24472506 group = append (group , kmsKeys ... )
24482507 group = append (group , cloudKmsKeys ... )
2508+ group = append (group , hckmsMkKeys ... )
24492509 group = append (group , azkvKeys ... )
24502510 group = append (group , pgpKeys ... )
24512511 group = append (group , hcVaultMkKeys ... )
0 commit comments