CN_USE_SOPS="age" ROOT_PATH=/usr/local/provisioning/kcl