getsops/sops · error

error loading config: cannot use more than one of encrypted_

Error message

error loading config: cannot use more than one of encrypted_suffix, unencrypted_suffix, encrypted_regex, unencrypted_regex, encrypted_comment_regex, or unencrypted_comment_regex for the same rule

What it means

configFromRule enforces that each creation rule specifies at most one mechanism for deciding which fields are encrypted: encrypted_suffix, unencrypted_suffix, encrypted_regex, unencrypted_regex, encrypted_comment_regex, or unencrypted_comment_regex. When the cryptRuleCount for a single creation rule exceeds one, sops refuses the rule because the selectors would conflict.

Source

Thrown at config/config.go:489

	}
	if rule.EncryptedSuffix != "" {
		cryptRuleCount++
	}
	if rule.UnencryptedRegex != "" {
		cryptRuleCount++
	}
	if rule.EncryptedRegex != "" {
		cryptRuleCount++
	}
	if rule.UnencryptedCommentRegex != "" {
		cryptRuleCount++
	}
	if rule.EncryptedCommentRegex != "" {
		cryptRuleCount++
	}

	if cryptRuleCount > 1 {
		return nil, fmt.Errorf("error loading config: cannot use more than one of encrypted_suffix, unencrypted_suffix, encrypted_regex, unencrypted_regex, encrypted_comment_regex, or unencrypted_comment_regex for the same rule")
	}

	groups, err := getKeyGroupsFromCreationRule(rule, kmsEncryptionContext)
	if err != nil {
		return nil, err
	}

	return &Config{
		KeyGroups:               groups,
		ShamirThreshold:         rule.ShamirThreshold,
		UnencryptedSuffix:       rule.UnencryptedSuffix,
		EncryptedSuffix:         rule.EncryptedSuffix,
		UnencryptedRegex:        rule.UnencryptedRegex,
		EncryptedRegex:          rule.EncryptedRegex,
		UnencryptedCommentRegex: rule.UnencryptedCommentRegex,
		EncryptedCommentRegex:   rule.EncryptedCommentRegex,
		MACOnlyEncrypted:        rule.MACOnlyEncrypted,
	}, nil

View on GitHub (pinned to 13442bb981)

Solutions

1. Keep only one of the six selector keys per creation rule — delete the redundant ones
2. Move conflicting selection strategies into separate creation_rules entries matched by distinct path_regex values
3. Prefer unencrypted_suffix: __ENC (the sops default) unless regex selection is truly required

Example fix

# before
creation_rules:
  - path_regex: '.*\.env'
    encrypted_suffix: '_ENC'
    unencrypted_regex: '^(API_KEY)$'
# after
creation_rules:
  - path_regex: '.*\.env'
    unencrypted_regex: '^(API_KEY)$'

selectors := []string{"encrypted_suffix","unencrypted_suffix","encrypted_regex","unencrypted_regex","encrypted_comment_regex","unencrypted_comment_regex"}
count := 0
for _, s := range selectors {
    if v, _ := rule[s].(string); v != "" { count++ }
}
if count > 1 {
    return errors.New("creation rule sets multiple crypt selector options")
}

cfg, err := configFromRule(rule, ctx)
if err != nil && strings.Contains(err.Error(), "cannot use more than one of") {
    return fmt.Errorf("rewrite creation rule to a single selector: %w", err)
}

When it happens

Trigger: A single creation_rules entry sets two or more of the six crypt selector keys, e.g. both encrypted_suffix and unencrypted_regex on the same rule.

Common situations: Merging team configs where one rule used suffix selection and another used regex selection; copy-pasting fields between rules; upgrading an old config that predates the comment-regex options.

Related errors

• error loading config: more than one destinations were found
• can not compile regexp: %w
• error loading config: no matching creation rules found
• could not read config file: %s
• error loading config: %s

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/72f21b0e171c42b4. Report an issue: GitHub.