Encrypt file using sops using a key store in Azure Vault in China

Errors:

Get Token request returned http error: 400 and server response: {"error":"invalid_resource","error_description":"AADSTS500011: The resource principal named https://vault.azure.net was not found in the tenant named [TENTANT_ID]. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.
Traceback (most recent call last):
...

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• az cloud set -n AzureChinaCloud - this doesn't seem to make a difference but is suppose to change the CLI to know its using China Cloud
• Have a key vault created and a key inside with encrypt and decrypt permission
• sops --encrypt --azure-kv https://[VAULT_NAME].vault.azure.cn/keys/[KEY_NAME] secrets.yaml

Expected Behavior

Instead of authorization using https://vault.azure.net it uses *.azure.cn so that it can find the correct tenant

Environment Summary

Linux-3.10.0-1062.4.3.el7.x86_64-x86_64-with-centos-7.9.2009-Core
Python 3.6.8
Installer: RPM

azure-cli 2.18.0

Start by tracing the Azure Key Vault authentication used by the --azure-kv entry point and compare it with az cloud set -n AzureChinaCloud. Reproduce with the redacted sops --encrypt command and the vault.azure.cn key URL. Done means token authorization targets the China Azure endpoint and encryption succeeds.