GCP Application Default Credentials refresh

[xakraz]

Hi there 👋🏻

We are using sops with GCP KMS for the key store.
It works great!

However, some of our developers face error messages from sops

Group 0: FAILED
  projects/******/locations/global/keyRings/****/cryptoKeys/****: FAILED
    - | Error decrypting key: Post
      | "<https://cloudkms.googleapis.com/v1/projects/*****/locations/global/keyRings/***/cryptoKeys/****:decrypt?alt=json&amp;prettyPrint=false>":
      | oauth2: cannot fetch token: 400 Bad Request
      | Response: {
      |   "error": "invalid_grant",
      |   "error_description": "Bad Request"
      | }

Recovery failed because no master key was able to decrypt the file.
In order for SOPS to recover the file, at least one key has to be successful, but none were.

My guess is that they face this error when the Application Default Credentials have not been refreshed on time by the gcloud cli usage or else.

I have 2 questions then 😇

1. Is my guessing right?
2. Would it be possible for sops to handle that part auto-magically or it is absolutely not possible and let up to the user to refresh the credentials by himself?

Thanks for your help 🙏🏻

[brandonwarren]

I had the same problem, and thanks to this question I tried
$ gcloud auth application-default login
and now it works!

[xakraz]

Yes, that is exactly the workaround 😄
However, I am expecting Sops to do it on its own using the google-cloud-sdk 😇