getsops/sops · error

Allowlist does not allow %s

Error message

Allowlist does not allow %s

What it means

Error "Allowlist does not allow %s" thrown in getsops/sops.

Source

Thrown at hcvault/keysource.go:406

	dataKey, err := base64.StdEncoding.DecodeString(plaintext)
	if err != nil {
		return nil, fmt.Errorf("cannot decode base64 plaintext into data key bytes")
	}
	return dataKey, nil
}

// vaultClient returns a new Vault client, configured with the given address
// and token.
func vaultClient(address, token string, hc *http.Client) (*api.Client, error) {
	cfg := api.DefaultConfig()
	cfg.Address = address

	allowlist, err := getAllowlist()
	if err != nil {
		return nil, err
	}
	if !allowlist.Allows(address) {
		return nil, fmt.Errorf("Allowlist does not allow %s", address)
	}

	if hc != nil {
		cfg.HttpClient = hc
	}

	client, err := api.NewClient(cfg)
	if err != nil {
		return nil, fmt.Errorf("cannot create Vault client: %w", err)
	}

	if token != "" {
		client.SetToken(token)
	}
	// Provided token takes precedence over the user's token.
	if client.Token() == "" {
		if token, err = userVaultToken(); err != nil {
			return nil, fmt.Errorf("cannot get Vault token: %w", err)

View on GitHub (pinned to 13442bb981)

When it happens

Trigger: Thrown at hcvault/keysource.go:406 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/41d736c5aa08fbd1. Report an issue: GitHub.