getsops/sops · error

failed to create HuaweiCloud KMS client: %w

Error message

failed to create HuaweiCloud KMS client: %w

What it means

EncryptContext failed while building the HuaweiCloud KMS client via createKMSClient — before any encrypt call. Typical wrapped causes are authentication failures (missing/wrong credentials), bad region, or network/DNS errors reaching the regional KMS endpoint.

Source

Thrown at hckms/keysource.go:146

func (c Credentials) ApplyToMasterKey(key *MasterKey) {
	key.credentials = c.credential
}

// Encrypt takes a SOPS data key, encrypts it with HuaweiCloud KMS and stores the result
// in the EncryptedKey field.
//
// Consider using EncryptContext instead.
func (key *MasterKey) Encrypt(dataKey []byte) error {
	return key.EncryptContext(context.Background(), dataKey)
}

// EncryptContext takes a SOPS data key, encrypts it with HuaweiCloud KMS and stores the result
// in the EncryptedKey field.
func (key *MasterKey) EncryptContext(ctx context.Context, dataKey []byte) error {
	client, err := key.createKMSClient(ctx)
	if err != nil {
		log.WithField("keyID", key.KeyID).Info("Encryption failed")
		return fmt.Errorf("failed to create HuaweiCloud KMS client: %w", err)
	}

	plaintext := base64.StdEncoding.EncodeToString(dataKey)
	encryptAlgorithm := model.GetEncryptDataRequestBodyEncryptionAlgorithmEnum().SYMMETRIC_DEFAULT

	request := &model.EncryptDataRequest{
		Body: &model.EncryptDataRequestBody{
			KeyId:               key.KeyUUID,
			PlainText:           plaintext,
			EncryptionAlgorithm: &encryptAlgorithm,
		},
	}

	response, err := client.EncryptData(request)
	if err != nil {
		log.WithField("keyID", key.KeyID).Info("Encryption failed")
		return fmt.Errorf("failed to encrypt sops data key with HuaweiCloud KMS: %w", err)
	}

View on GitHub (pinned to 13442bb981)

Solutions

1. Inspect the wrapped error: fix credentials (AK/SK, credential provider chain) first.
2. Verify the region prefix in KeyID matches a valid HuaweiCloud region with KMS enabled.
3. Check network/proxy reachability of the regional KMS endpoint (kms.<region>.myhuaweicloud.com).
4. If credentials come from a custom Credentials implementation, confirm it returns a valid auth.ICredential and the right region/project ID.

Example fix

// before: no credentials configured
creds := &hckms.Credentials{} // empty
// after: supply valid AK/SK via your credential setup so createKMSClient can auth
creds := hckms.NewCredentialsFromEnv() // e.g. HUAWEICLOUD_SDK_AK/SK

// Pre-flight: confirm credentials are resolvable and the region is valid
if os.Getenv("HUAWEICLOUD_SDK_AK") == "" && os.Getenv("HUAWEICLOUD_SDK_SK") == "" {
    return errors.New("HuaweiCloud credentials not configured")
}

null

if err := key.EncryptContext(ctx, dataKey); err != nil {
    if strings.Contains(err.Error(), "failed to create HuaweiCloud KMS client") {
        // do not retry auth failures; check AK/SK and region endpoint first
    }
    return err
}

When it happens

Trigger: MasterKey.EncryptContext calls key.createKMSClient(ctx) and it returns an error — invalid Credentials wrapper, unsupported/unknown region in KeyID, or HTTP failure constructing the huaweicloud SDK client.

Common situations: No HuaweiCloud credentials in the environment (missing AK/SK or credential provider); region part of the key ID misspelled so the endpoint URL is wrong; corporate proxy blocking the KMS endpoint; SDK auth region mismatch.

Related errors

• cannot create GCP KMS service: %w
• failed to encrypt sops data key with HuaweiCloud KMS: %w
• encryption response missing ciphertext
• failed to encrypt sops data key with GCP KMS key: %w
• invalid key ID format: expected 'region:key-uuid', got %q

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/ca3c1c626b0ae88e. Report an issue: GitHub.