What is the right way of look up of .sops.yaml recursively in sub-dir?

[jaythamke]

Hi,
I have following file-system and from root level I want to encrypt the secret files. But it does not work for following commands.

$ sops --encrypt secret.yaml 
error loading config: no matching creation rules found
$ sops --encrypt level_1/secret.yaml
error loading config: no matching creation rules found

$ tree -a
.
├── level_1
│   ├── level_2
│   │   └── level_3
│   │       └── .sops.yaml
│   └── secret.yaml
└── secret.yaml

My .sops.yaml looks like this -

$ cat level_1/level_2/level_3/.sops.yaml 
creation_rules:
- path_regex: 'secrets?\.ya?ml$'
  pgp: 5607E376BAEC53F90E91157A54C327E8F102B5A0

From the description under using-sops-yaml-conf-to-select-kms-pgp-for-new-files, I expected sops will look sops' config (.sops.yaml) recursively and when it finds it encrypt the secrets.

When creating any file under mysecretrepo, whether at the root or under a subdirectory, sops will recursively look for a .sops.yaml file. If one is found, the filename of the file being created is compared with the filename regexes of the configuration file. The first regex that matches is selected, and its KMS and PGP keys are used to encrypt the file.

Appreciate!

best regards,
Jayesh

[felixfontein]

I understand it that sops will search recursively up the tree, not down.

So if you have .sops.yaml in /, it will be found when encrypting something in /foo/bar/ -- assuming there's no .sops.yaml in /foo/ or /foo/bar/ itself.

(Seaching recursively down would be a performance nightmare.)

[jaythamke]

I misinterpret the documentation. I verified and encryption worked for me.

[stealthybox]

@felixfontein could it be a helpful behavior for sops to search up from the inputfile or outputfile path that is being encrypted rather than $PWD?

[felixfontein]

It could. Depending on whom you ask. Using cwd instead of input/output is a lot more consistent though, since intput and output can also be things like /dev/stdin / /dev/stdout, and you'd need to say what happens if both input and output paths are there and would lead to different .sops.yamls to be found.