Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings
Discussion options

xakraz
Oct 5, 2023

Hi there 👋🏻

We are using sops with GCP KMS for the key store.
It works great!

However, some of our developers face error messages from sops

Group 0: FAILED
  projects/******/locations/global/keyRings/****/cryptoKeys/****: FAILED
    - | Error decrypting key: Post
      | "<https://cloudkms.googleapis.com/v1/projects/*****/locations/global/keyRings/***/cryptoKeys/****:decrypt?alt=json&amp;prettyPrint=false>":
      | oauth2: cannot fetch token: 400 Bad Request
      | Response: {
      |   "error": "invalid_grant",
      |   "error_description": "Bad Request"
      | }

Recovery failed because no master key was able to decrypt the file.
In order for SOPS to recover the file, at least one key has to be successful, but none were.

My guess is that they face this error when the Application Default Credentials have not been refreshed on time by the gcloud cli usage or else.

I have 2 questions then 😇

  1. Is my guessing right?
  2. Would it be possible for sops to handle that part auto-magically or it is absolutely not possible and let up to the user to refresh the credentials by himself?

Thanks for your help 🙏🏻
You must be logged in to vote

Replies: 1 comment · 1 reply

Comment options

brandonwarren
May 13, 2024

I had the same problem, and thanks to this question I tried
$ gcloud auth application-default login
and now it works!
You must be logged in to vote
1 reply
@xakraz
Comment options

xakraz Aug 3, 2024
Author

Yes, that is exactly the workaround 😄
However, I am expecting Sops to do it on its own using the google-cloud-sdk 😇
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
🙏
Q&A
Labels
None yet
2 participants
@xakraz @brandonwarren
Morty Proxy This is a proxified and sanitized view of the page, visit original site.