How to change a sops encrypted secret without redeploy

Question

I have a cronjob deployed. I need to update a parameter -- rotate an AES key -- contained in the secret. The secret is sops encrypted.

Is it possible to update the AES key without redeploying the job?

What I have tried:

"kubectl edit secret jobsecret" -- edits the sops encrypted file but it is still encrypted
"helm edit secrets jobsecret.yaml" -- edits/encrypts the parameter file before deploy

My next thought is to create a file, then encrypt it with sops and copy/paste the result into the editor for "kubectl edit secret jobsecret". I was hoping that there was a better way.

I am a developer, not a k8s admin. But, not by choice. Filling in until we can remedy the "no k8s admin" issue.

Assuming that your aes_key is stored in `secret` in a `key`:`value` (value=aes_key) fashion you could try to use `$ kubectl patch secret YOUR_SECRET -p '{"data":{"aes_key":"NEW_BASE64_ENCODED_VALUE"}}'` Have you tried this way? Could you show the `YAML` definition of your `Job` and your `Secret`? Also please take a look on the official documentation about `Secret` that are mounted as `Volumes` (they are updated automatically): https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically — Dawid Kruk, Dec 09 '20 at 16:45
PERFECT!! Thank you! "kubectl patch secret" is the answer. I really appreciate it. There was no arrow to upvote your comment. If you want to put it in as an answer, I will be glad to mark it as the answer. — jim, Dec 10 '20 at 17:46

score 0 · Accepted Answer · answered Dec 10 '20 at 20:38

TL;DR

You can use $ kubectl patch to update fields of resources.

Example:

kubectl patch secret YOUR_SECRET -p '{"data":{"key":"NEW_BASE64_ENCODED_VALUE"}}'

You can find more reference here:

Kubernetes.io: Docs: Tasks: Managed Kubernetes objects: Update api object kubectl patch

I've included more explanation below.

Example of "patching" a secret:

$ secret.yaml

apiVersion: v1
kind: Secret
metadata:
  name: super-secret
data:
  username: a3J1aw==
  password: b2xkLXBhc3N3b3Jk

A side note!

Values of keys like username and password are base64 encoded!

To change the value of password you will need to run:

kubectl patch super-secret -p '{"data":{"password":"bmV3LXBhc3N3b3Jk"}}'

Displaying the newly updated secret should show (the output is only partial):

$ kubectl get secret super-secret -o yaml

data:
  password: bmV3LXBhc3N3b3Jk 
  username: a3J1aw==

I highly encourage you to check the additional reference:

How to change a sops encrypted secret without redeploy

1 Answers1