{"record":{"id":"72f21b0e171c42b4","repo":"getsops/sops","slug":"error-loading-config-cannot-use-more-than-one-of","errorCode":null,"errorMessage":"error loading config: cannot use more than one of encrypted_suffix, unencrypted_suffix, encrypted_regex, unencrypted_regex, encrypted_comment_regex, or unencrypted_comment_regex for the same rule","messagePattern":"error loading config: cannot use more than one of encrypted_suffix, unencrypted_suffix, encrypted_regex, unencrypted_regex, encrypted_comment_regex, or unencrypted_comment_regex for the same rule","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/config.go","lineNumber":489,"sourceCode":"\t}\n\tif rule.EncryptedSuffix != \"\" {\n\t\tcryptRuleCount++\n\t}\n\tif rule.UnencryptedRegex != \"\" {\n\t\tcryptRuleCount++\n\t}\n\tif rule.EncryptedRegex != \"\" {\n\t\tcryptRuleCount++\n\t}\n\tif rule.UnencryptedCommentRegex != \"\" {\n\t\tcryptRuleCount++\n\t}\n\tif rule.EncryptedCommentRegex != \"\" {\n\t\tcryptRuleCount++\n\t}\n\n\tif cryptRuleCount > 1 {\n\t\treturn nil, fmt.Errorf(\"error loading config: cannot use more than one of encrypted_suffix, unencrypted_suffix, encrypted_regex, unencrypted_regex, encrypted_comment_regex, or unencrypted_comment_regex for the same rule\")\n\t}\n\n\tgroups, err := getKeyGroupsFromCreationRule(rule, kmsEncryptionContext)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn &Config{\n\t\tKeyGroups:               groups,\n\t\tShamirThreshold:         rule.ShamirThreshold,\n\t\tUnencryptedSuffix:       rule.UnencryptedSuffix,\n\t\tEncryptedSuffix:         rule.EncryptedSuffix,\n\t\tUnencryptedRegex:        rule.UnencryptedRegex,\n\t\tEncryptedRegex:          rule.EncryptedRegex,\n\t\tUnencryptedCommentRegex: rule.UnencryptedCommentRegex,\n\t\tEncryptedCommentRegex:   rule.EncryptedCommentRegex,\n\t\tMACOnlyEncrypted:        rule.MACOnlyEncrypted,\n\t}, nil","sourceCodeStart":471,"sourceCodeEnd":507,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/config/config.go#L471-L507","documentation":"configFromRule enforces that each creation rule specifies at most one mechanism for deciding which fields are encrypted: encrypted_suffix, unencrypted_suffix, encrypted_regex, unencrypted_regex, encrypted_comment_regex, or unencrypted_comment_regex. When the cryptRuleCount for a single creation rule exceeds one, sops refuses the rule because the selectors would conflict.","triggerScenarios":"A single creation_rules entry sets two or more of the six crypt selector keys, e.g. both encrypted_suffix and unencrypted_regex on the same rule.","commonSituations":"Merging team configs where one rule used suffix selection and another used regex selection; copy-pasting fields between rules; upgrading an old config that predates the comment-regex options.","solutions":["Keep only one of the six selector keys per creation rule — delete the redundant ones","Move conflicting selection strategies into separate creation_rules entries matched by distinct path_regex values","Prefer unencrypted_suffix: __ENC (the sops default) unless regex selection is truly required"],"exampleFix":"# before\ncreation_rules:\n  - path_regex: '.*\\.env'\n    encrypted_suffix: '_ENC'\n    unencrypted_regex: '^(API_KEY)$'\n# after\ncreation_rules:\n  - path_regex: '.*\\.env'\n    unencrypted_regex: '^(API_KEY)$'","handlingStrategy":"validation","validationCode":"selectors := []string{\"encrypted_suffix\",\"unencrypted_suffix\",\"encrypted_regex\",\"unencrypted_regex\",\"encrypted_comment_regex\",\"unencrypted_comment_regex\"}\ncount := 0\nfor _, s := range selectors {\n    if v, _ := rule[s].(string); v != \"\" { count++ }\n}\nif count > 1 {\n    return errors.New(\"creation rule sets multiple crypt selector options\")\n}","typeGuard":null,"tryCatchPattern":"cfg, err := configFromRule(rule, ctx)\nif err != nil && strings.Contains(err.Error(), \"cannot use more than one of\") {\n    return fmt.Errorf(\"rewrite creation rule to a single selector: %w\", err)\n}","preventionTips":["Pick one selection strategy (default unencrypted_suffix) per rule and document it in the repo","When merging configs, review each creation rule for duplicate selector keys","Add a JSON/YAML schema check for .sops.yaml that forbids multiple selector keys in one rule"],"tags":["config","validation","creation-rules","sops"],"backgroundTag":"mutually-exclusive-config-options","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}