feat: Add Tencent Cloud KMS Support

[hoyeho]

Add Tencent Cloud KMS Support

Summary

This PR adds support for encrypting and decrypting SOPS files using Tencent Cloud KMS, similar to existing AWS KMS, GCP KMS, Azure Key Vault, and HuaweiCloud KMS integrations.

Changes

Core Implementation

• Added tencentkms package implementing MasterKey interface for Tencent Cloud KMS
• Integrated Tencent Cloud SDK for Go (github.com/tencentcloud/tencentcloud-sdk-go)
• Support for encryption/decryption operations via Tencent Cloud KMS API

CLI Integration

• Added --tencent-kms flag for encrypt and edit commands
• Added --add-tencent-kms and --rm-tencent-kms flags for rotate command
• Support for SOPS_TENCENT_KMS_IDS environment variable

Configuration Support

• Added Tencent Cloud KMS key support in .sops.yaml configuration files
• Key format: key-uuid (e.g., xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)

gRPC Keyservice Integration

• Added TencentKmsKey message to protobuf definitions
• Implemented encryption/decryption handlers in keyservice server

Storage Format

• Added tencent_kms key serialization in stores package
• Support for round-trip conversion (internal ↔ storage format)

Usage

Set credentials:

export TENCENTCLOUD_SECRET_ID="your-secret-id"
export TENCENTCLOUD_SECRET_KEY="your-secret-key"
export TENCENTCLOUD_REGION="ap-guangzhou"

Encrypt a file:

sops encrypt --tencent-kms "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" secrets.yaml > secrets.enc.yaml

Edit encrypted file:

sops edit secrets.enc.yaml

Rotate keys:

sops rotate --add-tencent-kms "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy" secrets.enc.yaml

Configuration File Example

# .sops.yaml
creation_rules:
  - path_regex: secrets/.*
    tencent_kms:
      - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Authentication

Tencent Cloud credentials can be provided via environment variables:

Variable	Required	Description
TENCENTCLOUD_SECRET_ID	Yes	Tencent Cloud Secret ID
TENCENTCLOUD_SECRET_KEY	Yes	Tencent Cloud Secret Key
TENCENTCLOUD_TOKEN	No	STS token for temporary credentials
TENCENTCLOUD_REGION	No	Region (default: ap-guangzhou)
TENCENTCLOUD_KMS_ENDPOINT	No	Custom KMS endpoint (use kms.internal.tencentcloudapi.com for CVM/TKE environments)

Testing

• ✅ Unit tests added
• ✅ Integration tests added (requires Tencent Cloud credentials)
• ✅ All existing tests pass
• ✅ Documentation check pass (make checkdocs)

Implementation Notes

• Follows the same patterns as AWS KMS, GCP KMS, Azure Key Vault, and HuaweiCloud KMS integrations for consistency
• Uses Tencent Cloud SDK for Go
• Supports optional STS token for temporary credentials
• Supports custom endpoint for internal network access in CVM/TKE environments

[hoyeho]

Hi maintainers — this PR is now ready for review.
I’ve run make test locally (and make checkdocs where applicable) and everything passed.
When you have a moment, could someone please approve the pending workflows so CI can run? Thanks!

[hoyeho]

Hi maintainers, this PR is ready.
Could someone with write access please approve and run the pending workflows (3 awaiting approval) and leave an approving review so the PR can be merged? Thanks!

[hoyeho]

Hi maintainers — I’ve resolved the merge conflict in CHANGELOG.md and committed the merge update.

Could someone please re-approve the pending workflows (if needed) and review the PR when you have a moment? Thanks!

[hoyeho]

Hi maintainers — I think the main question at this point is which Tencent KMS PR you want to move forward with.

PR #2032 is maintained by the Tencent Cloud KMS team and is intended to be the main Tencent KMS contribution going forward. Since HuaweiCloud KMS was merged in #2001, an in-tree KMS backend seems acceptable in principle. For Tencent KMS specifically, could you please clarify whether #2032 should be treated as the primary PR, and whether #1984 should be considered superseded?

Compared with #1984, this PR is rebased, mergeable, includes README/CHANGELOG updates, keyservice integration, and tests for the Tencent KMS implementation.

If #2032 is the preferred PR to continue with, could someone with write access please:

1. confirm that this is the PR to move forward with;
2. treat [Feature] Support Tencent Cloud KMS #1984 as superseded;
3. approve the pending workflows so CI can run;
4. request and/or leave a review here.

Thanks.

@felixfontein @sabre1041