error loading config: no matching destination found in confi

Error message

error loading config: no matching destination found in config

What it means

When a file matches a destination rule (or a rule is otherwise resolved), sops must find the matching dRule; if dRule is nil — no destination rule matched — config loading fails. This error means the lookup produced no destination rule, so sops cannot determine where the encrypted file should be published.

Source

Thrown at config/config.go:532

	if len(conf.DestinationRules) > 0 {
		for _, r := range conf.DestinationRules {
			if r.PathRegex == "" {
				dRule = &r
				rule = &dRule.RecreationRule
				break
			}
			if r.PathRegex != "" {
				if match, _ := regexp.MatchString(r.PathRegex, filePath); match {
					dRule = &r
					rule = &dRule.RecreationRule
					break
				}
			}
		}
	}

	if dRule == nil {
		return nil, fmt.Errorf("error loading config: no matching destination found in config")
	}

	var dest publish.Destination
	destinationCount := 0
	if dRule.S3Bucket != "" {
		destinationCount++
	}
	if dRule.GCSBucket != "" {
		destinationCount++
	}
	if dRule.VaultPath != "" {
		destinationCount++
	}

	if destinationCount > 1 {
		return nil, fmt.Errorf("error loading config: more than one destinations were found in a single destination rule, you can only use one per rule")
	}
	if dRule.S3Bucket != "" {

View on GitHub (pinned to 13442bb981)

Solutions

Broaden or fix the path_regex on the intended destination rule so it matches the file path passed to sops
Confirm the value passed to sops (relative vs absolute path) matches what the regex anchors against — add ^ or .* accordingly
Add a catch-all destination rule (path_regex: '.*') as the last entry if every file should publish somewhere
Verify the rule key names (s3_bucket, gcs_bucket, vault_path) are spelled correctly inside the rule

Example fix

# before
destination_rules:
  - path_regex: 'prod/.*'
    s3_bucket: 'my-bucket'
# after
destination_rules:
  - path_regex: '.*prod.*'
    s3_bucket: 'my-bucket'

Defensive patterns

Strategy: validation

Validate before calling

matched := false
for _, r := range cfg.DestinationRules {
    if re, err := regexp.Compile(r.PathRegex); err == nil && re.MatchString(filePath) {
        matched = true
        break
    }
}
if !matched {
    return fmt.Errorf("no destination rule matches %s", filePath)
}

Try / catch

cfg, err := loadConfigForFile(path)
if err != nil && strings.Contains(err.Error(), "no matching destination found") {
    return fmt.Errorf("add a destination rule covering %s", path)
}

Prevention

Test path_regex values against the exact paths passed to sops in your scripts
Keep a catch-all destination rule as the last entry if uploads are mandatory
Re-check destination rules after renaming or moving directories

When it happens

Trigger: Evaluating destination_rules against a file path where every rule's path_regex fails to match, or a destination_rules block exists but its match criteria exclude the current file, leaving dRule nil.

Common situations: Typo in the destination rule's path_regex; file located in a directory not covered by any destination rule; destination_rules added but expected match string doesn't account for the absolute vs relative path passed to sops.

Related errors

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/bf622eb028118b2f. Report an issue: GitHub.