SOPS with age different keys

[amirdamirov]

HI, fellows.

I have a question about age and sops integration.
I know that we can do it in .sops.yaml but here we only specify public key and the private key comes from variable $SOPS_AGE_KEY_FILE

In the documentation of AGE there is such option to specify private key with parametr "-i". But did not notice it with sops.

Is it possible to configure different key-pairs per folder in .sops.yaml ?

For example. I have this folder tree
A/B/DEV Encrypt it with age key-pair DEV
A/B/STAGE Encrypt it with age key-pair STAGE

[endorama]

I'm not sure if this helps, but you can put more than one key in the file referenced by SOPS_AGE_KEY_FILE.

I'm using a .sops.yml file with:

creation_rules:
    - path_regex: 'host_vars/foo.sops.tyml'
      age: 'age1a4bREDACTED'
    - path_regex: 'host_vars/bar.sops.yml'
      age: 'age1kn6REDACTED'

I have 3 keys in the key.txt file and sops <file> works.

If I understood your requirement correctly by specifying paths in .sops.yml with path_regex and adding more keys to key.txt you should be able to use different key pairs.

Is also possible to specify more than one Age Public Key in the age field of .sops.yml configuration file. You should then be able to decrypt it with either one of the keys.