getsops/sops · error

region cannot be empty in key ID: %q

Error message

region cannot be empty in key ID: %q

What it means

After splitting 'region:key-uuid' on the colon, parseKeyID trims the region part; if it is empty (e.g. the ID starts with ':' or the region is only spaces), it rejects the key ID because a region is required to build the KMS client endpoint.

Source

Thrown at hckms/keysource.go:108

		if err != nil {
			return nil, err
		}
		keys = append(keys, k)
	}
	return keys, nil
}

// parseKeyID parses a key ID in format "region:key-uuid" and returns the region and UUID.
func parseKeyID(keyID string) (string, string, error) {
	keyID = strings.TrimSpace(keyID)
	parts := strings.SplitN(keyID, ":", 2)
	if len(parts) != 2 {
		return "", "", fmt.Errorf("invalid key ID format: expected 'region:key-uuid', got %q", keyID)
	}
	region := strings.TrimSpace(parts[0])
	keyUUID := strings.TrimSpace(parts[1])
	if region == "" {
		return "", "", fmt.Errorf("region cannot be empty in key ID: %q", keyID)
	}
	if keyUUID == "" {
		return "", "", fmt.Errorf("key UUID cannot be empty in key ID: %q", keyID)
	}
	return region, keyUUID, nil
}

// Credentials is a wrapper around auth.ICredential used for authentication
// towards HuaweiCloud KMS.
type Credentials struct {
	credential auth.ICredential
}

// NewCredentials returns a Credentials object with the provided auth.ICredential.
func NewCredentials(c auth.ICredential) *Credentials {
	return &Credentials{credential: c}
}

View on GitHub (pinned to 13442bb981)

Solutions

1. Add the region before the colon, e.g. 'cn-north-4:<key-uuid>'.
2. If region comes from a variable/template, verify it is non-empty at render time.
3. Check for stray whitespace-only values that TrimSpace reduces to "".

Example fix

// before
// huawei://:9a8b7c6d-1234-5678-9abc-def012345678
// after
// huawei://cn-north-4:9a8b7c6d-1234-5678-9abc-def012345678

parts := strings.SplitN(strings.TrimSpace(keyID), ":", 2)
if len(parts) == 2 && strings.TrimSpace(parts[0]) == "" {
    return errors.New("region segment empty: prefix key ID with the HuaweiCloud region")
}

null

null

When it happens

Trigger: NewMasterKey given a key ID like ':uuid' or ': uuid' — colon present but the region segment is blank after TrimSpace.

Common situations: Deleting the region prefix during a config edit but leaving the colon; templating a .sops.yaml where the region variable rendered empty; copy-paste losing text before the colon.

Related errors

• invalid key ID format: expected 'region:key-uuid', got %q
• key UUID cannot be empty in key ID: %q
• no valid resource ID found in %q
• invalid region %q: %w
• failed to create HuaweiCloud KMS client: %w

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/728a79a12a759f85. Report an issue: GitHub.