need to encrypt user and password string in a yaml file using a regex

[GuillaumeBettayeb]

Hi everyone,

I have the following data file:

[..]
data:
  admin-user: admin
  admin-password: SomeSecurePasswordHere

I need to encrypt the admin-user and admin-password values with sops.

my .sops config file is:

---
creation_rules:
  - path_regex: values.*.yaml$
    kms: 'arn:aws:kms:xx-xxxx-1:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:role/kms_helm_secrets'
    encrypted_suffix: secrets

when I try encrypting in the command line with:
sops --encrypt --unencrypted-regex '(admin-[a-z]*)' myfile.yaml

it seems to be working, but when I try to encrypt the file itself, it fails with the following error message:

sops metadata not found

my question is, how can I encrypt the admin-user and admin-password strings with sops ?

thanks

[kokoc30]

Use encrypted_regex for the keys whose values should be encrypted. Your --unencrypted-regex does the reverse, and encrypted_suffix: secrets does not match either of those keys.

For the filename myfile.yaml in your command, a matching .sops.yaml rule is:

creation_rules:
  - path_regex: '(^|/)myfile[.]yaml
    kms: 'arn:aws:kms:REGION:ACCOUNT_ID:key/KEY_ID'
    encrypted_regex: '^admin-(user|password)$'

Replace the KMS placeholder with your actual KMS key ARN. The ARN shown in the question ends in role/..., which is not a KMS key ARN. Also make sure the path rule matches the actual filename: your original values.*.yaml$ rule would not match myfile.yaml.

Then encrypt the original plaintext file explicitly:

sops --encrypt --in-place myfile.yaml

Without --in-place, encryption writes the result to stdout and leaves the input unchanged. Keep only one of the suffix/regex selection settings in the matching rule.

The current configuration reference documents these selectors and the KMS ARN format. The regex matches key names at any depth, so other keys with exactly those names will be selected too. A later sops metadata not found error means the operation expected an already-encrypted SOPS document; it is not the command for initially encrypting plaintext.
kms: 'arn:aws:kms:REGION:ACCOUNT_ID:key/KEY_ID'
encrypted_regex: '^admin-(user|password)$'

Replace the KMS placeholder with your actual **KMS key ARN**. The ARN shown in the question ends in `role/...`, which is not a KMS key ARN. Also make sure the path rule matches the actual filename: your original `values.*.yaml$` rule would not match `myfile.yaml`.

Then encrypt the original plaintext file explicitly:

~~~sh
sops --encrypt --in-place myfile.yaml

Without --in-place, encryption writes the result to stdout and leaves the input unchanged. Keep only one of the suffix/regex selection settings in the matching rule.

The current configuration reference documents these selectors and the KMS ARN format. The regex matches key names at any depth, so other keys with exactly those names will be selected too. A later sops metadata not found error means the operation expected an already-encrypted SOPS document; it is not the command for initially encrypting plaintext.