feat: Add Tencent Cloud KMS Support

[hoyeho]

Add Tencent Cloud KMS Support

Summary

This PR adds support for encrypting and decrypting SOPS files using Tencent Cloud KMS, similar to existing AWS KMS, GCP KMS, Azure Key Vault, and HuaweiCloud KMS integrations.

Changes

Core Implementation

• Added tencentkms package implementing MasterKey interface for Tencent Cloud KMS
• Integrated Tencent Cloud SDK for Go (github.com/tencentcloud/tencentcloud-sdk-go)
• Support for encryption/decryption operations via Tencent Cloud KMS API

CLI Integration

• Added --tencent-kms flag for encrypt and edit commands
• Added --add-tencent-kms and --rm-tencent-kms flags for rotate command
• Support for SOPS_TENCENT_KMS_IDS environment variable

Configuration Support

• Added Tencent Cloud KMS key support in .sops.yaml configuration files
• Key format: key-uuid (e.g., xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)

gRPC Keyservice Integration

• Added TencentKmsKey message to protobuf definitions
• Implemented encryption/decryption handlers in keyservice server

Storage Format

• Added tencent_kms key serialization in stores package
• Support for round-trip conversion (internal ↔ storage format)

Usage

Set credentials:

export TENCENTCLOUD_SECRET_ID="your-secret-id"
export TENCENTCLOUD_SECRET_KEY="your-secret-key"
export TENCENTCLOUD_REGION="ap-guangzhou"

Encrypt a file:

sops encrypt --tencent-kms "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" secrets.yaml > secrets.enc.yaml

Edit encrypted file:

sops edit secrets.enc.yaml

Rotate keys:

sops rotate --add-tencent-kms "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy" secrets.enc.yaml

Configuration File Example

# .sops.yaml
creation_rules:
  - path_regex: secrets/.*
    tencent_kms:
      - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Authentication

Tencent Cloud credentials can be provided via environment variables:

Variable	Required	Description
TENCENTCLOUD_SECRET_ID	Yes	Tencent Cloud Secret ID
TENCENTCLOUD_SECRET_KEY	Yes	Tencent Cloud Secret Key
TENCENTCLOUD_TOKEN	No	STS token for temporary credentials
TENCENTCLOUD_REGION	No	Region (default: ap-guangzhou)
TENCENTCLOUD_KMS_ENDPOINT	No	Custom KMS endpoint (use kms.internal.tencentcloudapi.com for CVM/TKE environments)

Testing

• ✅ Unit tests added
• ✅ Integration tests added (requires Tencent Cloud credentials)
• ✅ All existing tests pass
• ✅ Documentation check pass (make checkdocs)

Implementation Notes

• Follows the same patterns as AWS KMS, GCP KMS, Azure Key Vault, and HuaweiCloud KMS integrations for consistency
• Uses Tencent Cloud SDK for Go
• Supports optional STS token for temporary credentials
• Supports custom endpoint for internal network access in CVM/TKE environments

[hoyeho]

Hi maintainers — this PR is now ready for review.
I’ve run make test locally (and make checkdocs where applicable) and everything passed.
When you have a moment, could someone please approve the pending workflows so CI can run? Thanks!