{"record":{"id":"ca3c1c626b0ae88e","repo":"getsops/sops","slug":"failed-to-create-huaweicloud-kms-client-w","errorCode":null,"errorMessage":"failed to create HuaweiCloud KMS client: %w","messagePattern":"failed to create HuaweiCloud KMS client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hckms/keysource.go","lineNumber":146,"sourceCode":"func (c Credentials) ApplyToMasterKey(key *MasterKey) {\n\tkey.credentials = c.credential\n}\n\n// Encrypt takes a SOPS data key, encrypts it with HuaweiCloud KMS and stores the result\n// in the EncryptedKey field.\n//\n// Consider using EncryptContext instead.\nfunc (key *MasterKey) Encrypt(dataKey []byte) error {\n\treturn key.EncryptContext(context.Background(), dataKey)\n}\n\n// EncryptContext takes a SOPS data key, encrypts it with HuaweiCloud KMS and stores the result\n// in the EncryptedKey field.\nfunc (key *MasterKey) EncryptContext(ctx context.Context, dataKey []byte) error {\n\tclient, err := key.createKMSClient(ctx)\n\tif err != nil {\n\t\tlog.WithField(\"keyID\", key.KeyID).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to create HuaweiCloud KMS client: %w\", err)\n\t}\n\n\tplaintext := base64.StdEncoding.EncodeToString(dataKey)\n\tencryptAlgorithm := model.GetEncryptDataRequestBodyEncryptionAlgorithmEnum().SYMMETRIC_DEFAULT\n\n\trequest := &model.EncryptDataRequest{\n\t\tBody: &model.EncryptDataRequestBody{\n\t\t\tKeyId:               key.KeyUUID,\n\t\t\tPlainText:           plaintext,\n\t\t\tEncryptionAlgorithm: &encryptAlgorithm,\n\t\t},\n\t}\n\n\tresponse, err := client.EncryptData(request)\n\tif err != nil {\n\t\tlog.WithField(\"keyID\", key.KeyID).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to encrypt sops data key with HuaweiCloud KMS: %w\", err)\n\t}","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/hckms/keysource.go#L128-L164","documentation":"EncryptContext failed while building the HuaweiCloud KMS client via createKMSClient — before any encrypt call. Typical wrapped causes are authentication failures (missing/wrong credentials), bad region, or network/DNS errors reaching the regional KMS endpoint.","triggerScenarios":"MasterKey.EncryptContext calls key.createKMSClient(ctx) and it returns an error — invalid Credentials wrapper, unsupported/unknown region in KeyID, or HTTP failure constructing the huaweicloud SDK client.","commonSituations":"No HuaweiCloud credentials in the environment (missing AK/SK or credential provider); region part of the key ID misspelled so the endpoint URL is wrong; corporate proxy blocking the KMS endpoint; SDK auth region mismatch.","solutions":["Inspect the wrapped error: fix credentials (AK/SK, credential provider chain) first.","Verify the region prefix in KeyID matches a valid HuaweiCloud region with KMS enabled.","Check network/proxy reachability of the regional KMS endpoint (kms.<region>.myhuaweicloud.com).","If credentials come from a custom Credentials implementation, confirm it returns a valid auth.ICredential and the right region/project ID."],"exampleFix":"// before: no credentials configured\ncreds := &hckms.Credentials{} // empty\n// after: supply valid AK/SK via your credential setup so createKMSClient can auth\ncreds := hckms.NewCredentialsFromEnv() // e.g. HUAWEICLOUD_SDK_AK/SK","handlingStrategy":"try-catch","validationCode":"// Pre-flight: confirm credentials are resolvable and the region is valid\nif os.Getenv(\"HUAWEICLOUD_SDK_AK\") == \"\" && os.Getenv(\"HUAWEICLOUD_SDK_SK\") == \"\" {\n    return errors.New(\"HuaweiCloud credentials not configured\")\n}","typeGuard":"null","tryCatchPattern":"if err := key.EncryptContext(ctx, dataKey); err != nil {\n    if strings.Contains(err.Error(), \"failed to create HuaweiCloud KMS client\") {\n        // do not retry auth failures; check AK/SK and region endpoint first\n    }\n    return err\n}","preventionTips":["Configure AK/SK (or another credential provider) before encryption steps in CI.","Validate the region segment of the key ID against the list of KMS-supported regions.","Test endpoint reachability (kms.<region>.myhuaweicloud.com) through any corporate proxy."],"tags":["huaweicloud","kms","credentials","encryption","network"],"backgroundTag":"kms-client-creation-failed","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}