What causes "error loading config: %s" in getsops/sops?

Run a YAML/TOML/JSON linter against the config file to find the syntax error (yamllint .sops.yaml)

error loading config: %s

Error message

error loading config: %s

What it means

After successfully reading the config file bytes, loadConfigFile calls conf.load to parse them (YAML/TOML/JSON) into the configFile struct. This error wraps any parsing/unmarshaling failure, so the config file exists but is malformed or does not match the expected schema.

Source

Thrown at config/config.go:462

		}
		for _, k := range vaultKeys {
			keyGroup = append(keyGroup, k)
		}
		groups = append(groups, keyGroup)
	}
	return groups, nil
}

func loadConfigFile(confPath string) (*configFile, error) {
	confBytes, err := os.ReadFile(confPath)
	if err != nil {
		return nil, fmt.Errorf("could not read config file: %s", err)
	}
	conf := &configFile{}
	conf.Stores = *NewStoresConfig()
	err = conf.load(confBytes)
	if err != nil {
		return nil, fmt.Errorf("error loading config: %s", err)
	}
	return conf, nil
}

func configFromRule(rule *creationRule, kmsEncryptionContext map[string]*string) (*Config, error) {
	cryptRuleCount := 0
	if rule.UnencryptedSuffix != "" {
		cryptRuleCount++
	}
	if rule.EncryptedSuffix != "" {
		cryptRuleCount++
	}
	if rule.UnencryptedRegex != "" {
		cryptRuleCount++
	}
	if rule.EncryptedRegex != "" {
		cryptRuleCount++
	}

View on GitHub (pinned to 13442bb981)

Solutions

Run a YAML/TOML/JSON linter against the config file to find the syntax error (yamllint .sops.yaml)
Check indentation: YAML files must use consistent spaces, never tabs
Validate that top-level keys are creation_rules and destination_rules with correct types (lists of maps)
Restore a known-good config from git history: git diff HEAD -- .sops.yaml

Example fix

# before (tabs break YAML)
creation_rules:
	- path_regex: .*\.yaml
# after
creation_rules:
  - path_regex: '.*\.yaml'

Defensive patterns

Strategy: validation

Validate before calling

var raw map[string]interface{}
if err := yaml.Unmarshal(confBytes, &raw); err != nil {
    return fmt.Errorf("config file is not valid YAML: %w", err)
}

Try / catch

conf, err := loadConfigFile(confPath)
if err != nil && strings.HasPrefix(err.Error(), "error loading config:") {
    // point the operator at the file and run yamllint on it
    return fmt.Errorf("fix syntax in %s: %w", confPath, err)
}

Prevention

Lint .sops.yaml with yamllint or a JSON/TOML parser in CI
Use spaces, never tabs, in YAML configs
Keep a known-good example config in the repo for reference
Validate config changes with a dry-run sops command before merging

When it happens

Trigger: conf.load(confBytes) returns an error because the file contains invalid YAML/TOML/JSON syntax, wrong indentation, tabs in YAML, or unexpected field types for known keys.

Common situations: Hand-edited .sops.yaml with broken indentation; pasting TOML config into a file inferred as YAML; key typo producing a schema mismatch in strict parsers.

Related errors

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/9c7b31c78b733c3e. Report an issue: GitHub.