SOPS Decryption Issue with Azure Key Vault

Environment

• Platform: Azure
• Tool: SOPS
• Target: GitOps encrypted secrets
• OS: Linux
• -SOPS Version: sops 3.9.2
  -Azure CLI Version: "azure-cli": "2.72.0",
  "azure-cli-core": "2.72.0",
  "azure-cli-telemetry": "1.1.0",
  "extensions": {}

Issue Description

Unable to decrypt SOPS-encrypted files using Azure Key Vault. Getting authentication errors when trying to access the key vault.

Error Message

Failed to get the data key required to decrypt the SOPS file.

Group 0: FAILED
[https://kv-prod-estca-gestiac-1.vault.azure.net/keys/[...]//vscode-app/): FAILED
- | failed to decrypt sops data key with Azure Key Vault key
| '[https://kv-prod-estca-gestiac-1.vault.azure.net/keys/[...]':
| DefaultAzureCredential: failed to acquire a token.
| Attempted credentials:
| EnvironmentCredential: incomplete environment variable
| configuration. Only AZURE_TENANT_ID and AZURE_CLIENT_ID are
| set
| WorkloadIdentityCredential: no token file specified. Check
| pod configuration or set TokenFilePath in the options
| ManagedIdentityCredential: managed identity timed out. See
| [https://aka.ms/azsdk/go/identity/troubleshoot#dac](vscode-file://vscode-app/c:/Users/cavn02/AppData/Local/Programs/Microsoft%20VS%20Code/resources/app/out/vs/code/electron-sandbox/workbench/workbench.html) for more


| information
| AzureCLICredential isn't configured to acquire tokens for
| tenant "c4ceb57f-7df7-41d1-8b97-a85048b8e95e". To enable
| acquiring tokens for this tenant add it to the
| AdditionallyAllowedTenants on the credential options, or add
| "*" to allow acquiring tokens for any tenant
DefaultAzureCredential: failed to acquire a token.
Attempted credentials:
- EnvironmentCredential: incomplete environment variable configuration
- WorkloadIdentityCredential: no token file specified
- ManagedIdentityCredential: managed identity timed out
- AzureCLICredential: not configured for tenant

Current Setup

• Using SOPS with Azure Key Vault integration
• Key Vault name: kv-prod-estca-gestiac-1
• Key name: arhos-sops-nonprod
• File type: YAML secrets for OpenShift configuration

What I've Tried

1. Azure CLI login
2. Setting required environment variables:
   • AZURE_TENANT_ID
   • AZURE_CLIENT_ID
3. Verifying Key Vault access using az cli
4. Checking network connectivity to Key Vault
5. Verifying key permissions

Questions

1. What's the recommended authentication method for CI/CD pipeline usage?
2. Are there specific environment variables required beyond TENANT_ID and CLIENT_ID?
3. What's the minimum required permission set for key access?
4. Is there a way to debug the authentication flow?

Start with the reported DefaultAzureCredential error and the SOPS Azure Key Vault integration, using the listed SOPS 3.9.2 and Azure CLI 2.72.0 setup as the reproduction context. Compare the attempted environment variables, CLI tenant configuration, and stated Key Vault permissions with the authentication requirements for CI/CD. Done should identify the cause, required configuration and permissions, and a practical debugging path.