getsops/sops · error

failed to get HuaweiCloud credentials: %w

Error message

failed to get HuaweiCloud credentials: %w

What it means

When no credentials were injected via hckms.Credentials, createKMSClient uses the SDK's BasicCredentialProviderChain (env vars -> config profile -> ECS metadata). If GetCredentials finds no usable credentials, the failure is wrapped here (hckms/keysource.go:274) and aborts both encrypt and decrypt.

Source

Thrown at hckms/keysource.go:274

// TypeToIdentifier returns the string identifier for the MasterKey type.
func (key *MasterKey) TypeToIdentifier() string {
	return KeyTypeIdentifier
}

// createKMSClient creates a HuaweiCloud KMS client with the appropriate credentials
// and region configuration.
func (key *MasterKey) createKMSClient(ctx context.Context) (*huaweikms.KmsClient, error) {
	var cred auth.ICredential
	var err error

	if key.credentials != nil {
		cred = key.credentials
	} else {
		// Use default credential provider chain (env -> profile -> metadata)
		credentialProviderChain := provider.BasicCredentialProviderChain()
		cred, err = credentialProviderChain.GetCredentials()
		if err != nil {
			return nil, fmt.Errorf("failed to get HuaweiCloud credentials: %w", err)
		}
	}

	// Get KMS region with endpoint
	reg, err := kmsregion.SafeValueOf(key.Region)
	if err != nil {
		return nil, fmt.Errorf("invalid region %q: %w", key.Region, err)
	}

	// Create HTTP client builder
	hcClientBuilder := core.NewHcHttpClientBuilder().
		WithCredential(cred).
		WithRegion(reg)

	hcClient := hcClientBuilder.Build()

	// Create KMS client
	kmsClient := huaweikms.NewKmsClient(hcClient)

View on GitHub (pinned to 13442bb981)

Solutions

1. Set the HuaweiCloud credential environment variables expected by the provider chain (access key + secret key) before running sops
2. Create a valid credentials/config profile file for the SDK's profile provider
3. Inject credentials programmatically via hckms.NewCredentials(credential).ApplyToMasterKey(key) when using the keyservice API
4. Run the workload on an ECS with an attached IAM agency so metadata credentials resolve

Example fix

// before
$ sops -d secrets.yaml
// after (CI)
$ export HC_ACCESS_KEY_ID="$HUAWEI_AK"
$ export HC_SECRET_ACCESS_KEY="$HUAWEI_SK"
$ sops -d secrets.yaml

// Go: fail fast before touching KMS
if _, err := provider.BasicCredentialProviderChain().GetCredentials(); err != nil {
    log.Fatal("HuaweiCloud credentials not found; set HC access/secret env vars or an SDK profile")
}

if _, err := key.Decrypt(); err != nil {
    var credErr error
    if errors.As(err, &credErr) && strings.Contains(err.Error(), "failed to get HuaweiCloud credentials") {
        return fmt.Errorf("no HuaweiCloud credentials: configure env vars, profile, or ECS metadata")
    }
    return err
}

When it happens

Trigger: EncryptContext or DecryptContext is called with key.credentials == nil and the default provider chain cannot resolve credentials: no HuaweiCloud env vars, no config profile file, and no ECS metadata endpoint reachable.

Common situations: CI/CD runner without HuaweiCloud secrets configured; local machine where ~/.huaweicloud profile was never created or is unreadable; typo'd environment variable names; running in a container off-ECS where metadata service is unreachable.

Related errors

• failed to get Azure token credential to decrypt: %w
• failed to create HuaweiCloud KMS client: %w
• failed to get Azure token credential to retrieve key version
• failed to get Azure token credential to encrypt data: %w
• failed to encrypt sops data key with Azure Key Vault key '%s

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/76d80232340b3904. Report an issue: GitHub.