how to define in-place in .sops.yaml and how to refer different .sops.yaml config

[jaythamke]

1. The --in-place is useful flag, I particularly use .sops.yaml but I could not figure out how can I use --in-place flag inside creation rules and encrypt the existing clear text YAML file. How to configure it inside .sops.yaml
2. I want to use .sops.yaml from different directory to encrypt the secrets, I tried with --config and set the path (absolute as well as relative path) of .sops.yaml files but sops does not use specified config files to encrypt the data. What is the correct way to configure it?
   Appreciate!

regards,
Jayesh

[felixfontein]

Regarding 1: I don't think that's possible, and I also don't think it would make sense to uspport --in-place via a (global) config. It is a flag which controls which specific files are used for some operations.

Regarding 2: I don't think that's supported. sops only supports a single configuration file and does not support merging multiple ones on the fly.

[jaythamke]

Thanks for your answer,
I experimented with --config flag. Earlier, I used the flag wrong way sops -e secret.yaml --config sops.conf.hc_vault.yaml --config sops.conf.gpg.yaml which returned config file not found and no keys provided through command line options. I then corrected and observed the results, see below -

$ sops -e --config sops.conf.gpg.yaml --config sops.conf.hc_vault.yaml secret.yaml 
foo: ENC[AES256_GCM,data:qlze,iv:r7ZS2C+dy1NgPZ3Cag/UnePC3yaxN19/uIIwfT1q80o=,tag:5L9tj4M7YsycFJ7/Dnn9pA==,type:str]
sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault:
        - vault_address: http://127.0.0.1:8200
          engine_path: sops
          key_name: firstkey
          created_at: "2021-10-27T06:48:24Z"
          enc: vault:v1:l6QWj46OdX+k1G9cCZpFTi76NyCJWsgJY19yYqtUd3RFf0omI20GoYFo4oHSUGBo8HDfSQlCrsOuZyFJqTQQaax+tDIWKn0xHR5zUBpmuo6E+WCqrrDwbYUiB7zUwt9nKIA3l7EEeYBMQVUhG5lAThFu9A/DJatZjAc5RBidqGS8NONgPhiw9GpVImdnwjE9w62h9vMSuv69HGcKTI7owV0DkJmK1O/osezyglqz/kdm1Q4/5ZlQiEc22PG7kClXyDnW32nZKM/XP+eVCN0YhR32PTEWcn0B3BUy9AtRIg3VGN8jOE0YRYb+YGNqThDptNCW93hHIVyd0nMYYJwjr8P5AU8SviXttSb1ghZUit9di0jIdQxV3bUJZ583sxcPSPUOLTbH/HtLmVaF/voOrvPBkpiyBvN9dWn4d3gN24x9oqH9lYij+7PAok9uBA8g9b65fqsnKIIR9MO4VJYQyBGQZC1E0gdVMVE1GTTixz4qOYFwGDbuQTifGD2eCCewv8TCZmYkdSdBX4iyhuiEI6ulCX6BaBo2mZN7Kz6vMnStraaZ5poRLqRub8DyiC67ADBKlzJSRMf+VNK0Pc5TtdfLApMrLcVqcnTp4XGgypbcxGZM0lbCaNbr2+jUm7z7SQkeYP1CMCqPVYhRLX/rMEj7BjT8hzatkgaANnI7WN8=
    age: []
    lastmodified: "2021-10-27T06:48:24Z"
    mac: ENC[AES256_GCM,data:38klzVCGO0Plgxf4xYFzUVK1g2p1d8PCqlyAMJRvdl8IA6BFLJamkt7v96zrXnhUqjbtYkRH/TjFjhgX4+VIC3mGT6olQMd9EEV2fZIfKzhCwZS4JhAc0TeDB0z+4lr/CSqj4yJXrJkaq27MJFaLMhRjk1Msv71Bj6lZB4bj424=,iv:tWNrQKj1M5dtrZLRzNWYRWKx7bMxr/9A7vL1A1vKNq0=,tag:YfQiRh8KZGr3/FxOWD2n8w==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.7.1
$ sops -e --config sops.conf.hc_vault.yaml --config sops.conf.gpg.yaml secret.yaml
[PGP]    WARN[0000] Deprecation Warning: GPG key fetching from a keyserver within sops will be removed in a future version of sops. See https://github.com/mozilla/sops/issues/727 for more information. 
foo: ENC[AES256_GCM,data:2rd2,iv:JqtAYfR55NlbBC4QdfQBcMBDspKQjGiYe8AlJiZmg1Y=,tag:wDA0qpMPOuX3jX7qITtYNQ==,type:str]
sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age: []
    lastmodified: "2021-10-27T06:48:48Z"
    mac: ENC[AES256_GCM,data:hwOo/dw3ka/SXGQoe29Waye0bhUaIKjEDsh0o4NbRBkJTkvCXeZQCI2PfkauRvug+98hW1qgX4KzlNKmRJcFQrdOlcDZjwjRLQL543+qAlgbXfiOMlafzqhrON+0ZhgEKzOVpcUHM/TuRoyky+XFQIDBkuL5jNj08v+RZy5SUf0=,iv:2VMx3hgfZgepIAsp+OYTN3iR5lnEgj5vYxQ3NAY+SMA=,tag:VJHKWk/72hnIt70R5SOZzw==,type:str]
    pgp:
        - created_at: "2021-10-27T06:48:47Z"
          enc: |
            -----BEGIN PGP MESSAGE-----

            hQGMA/G8Ery4ebujAQv/apGK3Pf+hS34ik2HdJKHKI0vmdjtzMIDPQRKOJD6kuGq
            A//baAWrjrNPzLvBg4FS3FvpLzJU7if1qdJbU/HOZceFM1MJeK9JZhSXEmwzqNMP
            xrmXTwE081qW8SvcvyutggRM+OqKEQjm8ZJ+NDdEMCKoxTEqF1938u5wreL8LWUn
            V/hKdDO5dLnUhE8AvMSy83piIALPIRjYaCzop4hgj2inPhJ1KYx8TwOX6fvITozu
            DKitLkvmHw00+IldZNwR8o6i1LrddXAL5MSt6Xrlj8hbp7yhRPjvKbskVqXyxnXj
            fXUOyMLyH09jwjWud3vy15CYF2q+UZf7yX9U2KsqWW8f4DPs8CMUiClz6Z2P0VuU
            pROcilD2FYvwkon0D0cCj47i5gTH3h3I+z18KnT+/2kWiK44dLecqR/dYJdllK4i
            B/93HS89ljbxBLvHWDimYacuPNe5MYDwgCBOnD9JkRcKCcCgY62UtrCeGzBeUr0d
            MkY/ALHrhITWvUdJ4SOS0l4BULv6ybuqFYTgLm9lX+37uXetEPTHd+uITVlUA9Zj
            KvhcCOYhLuruAgfsrW0g7F9h7PwCaNNMwb98whCbN3RFjTBjEKE4Wbi1fRx29nGy
            7zDSyzmzZJHsdUL62Lkc
            =W94v
            -----END PGP MESSAGE-----
          fp: 5607E376BAEC53F90E91157A54C327E8F102B5A0
    unencrypted_suffix: _unencrypted
    version: 3.7.1

I observed the latest value of --config flag takes precedence but of course not both. This basically answers my second question ;)

regards,
Jayesh