Add SOPS_GCP_KMS_CLIENT_TYPE environment variable support

README.rst

@@ -309,6 +309,14 @@ Or if you are logged in you can authorize by generating an access token:
 
     $ export GOOGLE_OAUTH_ACCESS_TOKEN="$(gcloud auth print-access-token)"
 
+By default, SOPS uses the gRPC client to communicate with GCP KMS. You can optionally
+switch to the REST client by setting the ``SOPS_GCP_KMS_CLIENT_TYPE`` environment variable:
+
+.. code:: sh
+
+    $ export SOPS_GCP_KMS_CLIENT_TYPE=rest  # Use REST client
+    $ export SOPS_GCP_KMS_CLIENT_TYPE=grpc  # Use gRPC client (default)
+
 Encrypting/decrypting with GCP KMS requires a KMS ResourceID. You can use the
 cloud console the get the ResourceID or you can create one using the gcloud
 sdk:

gcpkms/keysource.go

@@ -27,6 +27,9 @@ const (
 	// SopsGoogleCredentialsOAuthTokenEnv is the environment variable used for the
 	// GCP OAuth 2.0 Token.
 	SopsGoogleCredentialsOAuthTokenEnv = "GOOGLE_OAUTH_ACCESS_TOKEN"
+	// SopsGCPKMSClientTypeEnv is the environment variable used to specify the
+	// GCP KMS client type. Valid values are "grpc" (default) and "rest".
+	SopsGCPKMSClientTypeEnv = "SOPS_GCP_KMS_CLIENT_TYPE"
 	// KeyTypeIdentifier is the string used to identify a GCP KMS MasterKey.
 	KeyTypeIdentifier = "gcp_kms"
 )
@@ -294,7 +297,21 @@ func (key *MasterKey) newKMSClient(ctx context.Context) (*kms.KeyManagementClien
 		}
 	}
 
-	client, err := kms.NewKeyManagementClient(ctx, opts...)
+	// Select client type based on environment variable
+	clientType := os.Getenv(SopsGCPKMSClientTypeEnv)
+	var client *kms.KeyManagementClient
+	var err error
+
+	switch strings.ToLower(clientType) {
+	case "rest":
+		client, err = kms.NewKeyManagementRESTClient(ctx, opts...)
+	case "grpc", "":
+		// Default to gRPC client when not specified or explicitly set to "grpc"
+		client, err = kms.NewKeyManagementClient(ctx, opts...)
+	default:
+		return nil, fmt.Errorf("invalid client type %q specified in %s environment variable: valid values are 'grpc' or 'rest'", clientType, SopsGCPKMSClientTypeEnv)
+	}
+
 	if err != nil {
 		return nil, err
 	}