Keep track of many public keys in .sops.yaml

[ndrpnt]

Hi there,

Is it possible to somehow add comments to the list of age public keys in .sops.yaml ? We use multiple keys but because they are specified as a single string, it is hard to keep track of which one belong to whom, e.g.

creation_rules:
  - path_regex: …
    encrypted_regex: …
    mac_only_encrypted: true
    age: >-
      age1z9f4…, # Can't write a comment here !
      age1e67n…,
      age1yy1e…,
      age1kto7…,
      age1mhxn…,
      age133rr…,
      age1jy4m…

Has anyone encountered that limitation before ? Any elegant solution ?

Thanks 🙏

[felixfontein]

I personally generate my .sops.yaml files with a small Ansible playbook that templates the .sops.yaml file based on data stored in a more structured way. I mainly use GPG keys, and I store them in a directory (one public key per file, named after the person and date when added). The Ansible playbook takes these keys, uses the community.crypto.gpg_fingerprint lookup to extract their fingerprints, and templates .sops.yaml with these fingerprints. For me Ansible is a natural choice since I use SOPS mainly to manage secrets for Ansible anyway :)

I'd put age keys in a list (with comments for each list item with more info, like owner and created timestamp, or something like that), and use that list to generate the corresponding .sops.yaml entries.

My script roughly looks like this: https://github.com/felixfontein/cfgmgmtcamp-2025-talk/blob/main/demo-1-sops/create-config.yml - I also had variants of this for slightly different use-cases, some versions including using the ansible.builtin.fileglob lookup to look up all public key files in a directory.

[ndrpnt]

Thanks for sharing! Generating .sops.yaml comes with a bit of overhead though, as that would imply adding yet another tool in my case.

For lack of a better alternative, I am living with this:

creation_rules:
  # age1z9f4… Tom
  # age1e67n… Dick
  # age1jy4m… Harry
  - age: >-
      age1z9f4…,
      age1e67n…,
      age1jy4m…

[ndrpnt]

Answering my own question, it is possible to use Key groups to structure your configuration this way:

creation_rules:
  - path_regex: …
    encrypted_regex: …
    mac_only_encrypted: true
    key_groups:
      - age:
          - age1z9f4… # Tom
          - age1e67n… # Dick
          - age1yy1e… # Hary