Sops: How to create .sops.yaml for azure?

[feniix]

I have been trying to create a sops config for azure without success

when I use sops with azure from command line: sops --azure-kv https://sops.vault.azure.net/keys/sops-key/some-string --input-type yaml --output-type yaml -e secret.yaml.dec the output looks like:

test:
    mytest: ENC[AES256_GCM,data:Torlrw0QcoI=,iv:Ayqfl9R1oXmtFEpZSIRPv+r90yWJE1VVK+OJdt0CH7E=,tag:gKmGr8+ertZ13dn/q426DQ==,type:str]
sops:
    kms: []
    gcp_kms: []
    azure_kv:
    -   vault_url: https://sops.vault.azure.net
        name: sops-key
        version: some-string
        created_at: '2019-03-07T01:06:26Z'
        enc: paUeFSlLUVrXycPqsZ36n920OGTD-8xJokx63iFgI5aFp0W8J0RYTy_UeWReQ6G24HpqwEADUpJ5F1mnGTmgzJm9NxKdUS4F7hT10lZMzOaVJ5LJvuQhnO9tuw5FZiuKSor4UMg58vIZD6IXWh3pjO6Fyo5FdStzzWFllBYyMYsKB5pDDqy-5EUuZ1ZYxWTPNI4X9aD-LYU9Irq_zdq0kqq2cbbN23ZTwUQA2rCC64on847EpCWJTWAyPQMhxFSdbSZel_XN2yzsz9H4IgqOM4mEf_xNlDFmYNWi5FvalZ4gmeARXnWUXn_A8vhc3NTT5PMTsWMCN4_AQWxdisyGMA
    lastmodified: '2019-03-07T01:06:30Z'
    mac: ENC[AES256_GCM,data:0qkcQOfaaUou7WFfh8Iv1MZr9YScFl+PnQ9IVQmM/TQAjgmJ8Wrnax9X/jP3VZWPOsr+ztRkg2V4DkNFJkheU1gAlF1vlsdjaR7TQoJmr999niEHgv6Px1Kx1AbfnuCvrw+aOQVXoCt5tF5YKNUd4qv5UqS93DI+IqI6UashKyw=,iv:vLSE3vb5iXxVRA+wSKjRDDdnK2qXd/orqJxyQDRNCJk=,tag:g+utpeDSzdWUkLMzppGBfQ==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.2.0

When I create a .sops.yaml file that looks like this:

creation_rules:
  - path_regex: secret.*\.yaml(.dec)?$
    azure_kv: https://sops.vault.azure.net/keys/sops-key/some-string

then I attempt to encrypt a file sops --input-type yaml --output-type yaml -e secret.yaml.dec and it does not add the azure key info to the output

test:
    mytest: ENC[AES256_GCM,data:w7hU9kRzAZk=,iv:c/e8Vwnjb5D+Kw9b2PuID5vaL0dLj03n8gBo5Wwqu3s=,tag:ZDHnQkwHhFtgdKAX9kXacQ==,type:str]
sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    lastmodified: '2019-03-07T01:04:40Z'
    mac: ENC[AES256_GCM,data:CVuQnDW3PQpb9ETvX8pasul0F/5aEOA0O7FMS08iaOL/99pW2AeDT32/cnfjqpfFG8curh/a0bPgktjyC+ps+HKK70qKPUquNPMNm6+CP92+qoRGd22g4eqoCV1tmwgrNmhEvhYHJhzjCx6r9CQGmpHHnUiaId3yNZThZ/uyNhU=,iv:7JdRC0+nQYeDmCBsv8f6vc2dbwEyxBXQOAxlMHjDZhs=,tag:KwMdkSjFS+Fzgh05yi+Z9g==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.2.0

does anybody know how to configure the .sops.yaml properly? or azure_kv is not supported with configuration files?

[feniix]

oh found it

from source: https://github.com/mozilla/sops/blob/8c8d780abb1bbc767ee0452ff352dd2ac1148392/config/config.go#L69

the key is azure_keyvault

creation_rules:
  - path_regex: secret.*\.yaml(.dec)?$
    azure_keyvault: https://sops.vault.azure.net/keys/sops-key/some-string

sops --verbose --input-type yaml --output-type yaml -e secret.yaml.dec [AZKV] INFO[0002] Encryption succeeded key=sops-key version=ae2cb1866b76443398ae1fbaa41c442d test: mytest: ENC[AES256_GCM,data:KJOWhTkjkag=,iv:Ifb4O0cIFV3QWSHHhiHZixzwRF7K9mMCZ0Cisv6ib8c=,tag:Ui29dbOwbV84qegje313Gw==,type:str] sops: kms: [] gcp_kms: [] azure_kv: - vault_url: https://sops.vault.azure.net name: sops-key version: some-string created_at: '2019-03-07T01:28:47Z' enc: qpza_A1uDkW7ZSirqlsDPvQpOjQgsyceWVnQfk0habHmLshpR52HHLXKgTFR6G3sMKhenQmEbZ5lmo0AMFHY_ZcCz29EcbJNjn1CWGFRfE0NuWs2VCEJiB-yvLac9FCZL0cwIOfnsfBeXIAJTMsUE6LDVX5eDAoSAvq7yegZNUf3L5EosXtwDJ0zJxqojSFyRBfO-eH3H1o-ElWatRn7AIhL9OFrs9lGSmxAHIAt3w8h4YXZGwF69v3uyGwH08ohchXURJhgSZ7hQiPbF7YO0d5qWB0TBsMIFt1MgcJln3ZSfdo-d254b1uKqMz3Y_siDk0wA5umwZtMQnfyYgRkTg lastmodified: '2019-03-07T01:28:50Z' mac: ENC[AES256_GCM,data:sD3g7TVTU2ktBEtsxc3pVa1B4cj/oKh39G3Wmp7YbuaLQsZwn6mtiM3b4Z0zbMqVANyg/kYTDxMOEnSA0+2bliKffCGlpGtLyEpyqN56GrHIkXvvPK2t6JK9C8tmzv+r58EwcgP9BRZBT6ilysxp3BazzJ9KPnbolZTzst8TjlA=,iv:NLPCCobq+062uDqR4kTO515qccCRSRiULMnCjj2outs=,tag:TdIbjAEhFAQ6pU8FjKRt+A==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.2.0