I have a cronjob deployed. I need to update a parameter -- rotate an AES key -- contained in the secret. The secret is sops encrypted.

Is it possible to update the AES key without redeploying the job?

What I have tried:

"kubectl edit secret jobsecret" -- edits the sops encrypted file but it is still encrypted
"helm edit secrets jobsecret.yaml" -- edits/encrypts the parameter file before deploy

My next thought is to create a file, then encrypt it with sops and copy/paste the result into the editor for "kubectl edit secret jobsecret". I was hoping that there was a better way.

I am a developer, not a k8s admin. But, not by choice. Filling in until we can remedy the "no k8s admin" issue.

  • Assuming that your aes_key is stored in secret in a key:value (value=aes_key) fashion you could try to use $ kubectl patch secret YOUR_SECRET -p '{"data":{"aes_key":"NEW_BASE64_ENCODED_VALUE"}}' Have you tried this way? Could you show the YAML definition of your Job and your Secret? Also please take a look on the official documentation about Secret that are mounted as Volumes (they are updated automatically): kubernetes.io/docs/concepts/configuration/secret/…
    – Dawid Kruk
    Dec 9, 2020 at 16:45
  • PERFECT!! Thank you! "kubectl patch secret" is the answer. I really appreciate it. There was no arrow to upvote your comment. If you want to put it in as an answer, I will be glad to mark it as the answer.
    – jim
    Dec 10, 2020 at 17:46

1 Answer 1



You can use $ kubectl patch to update fields of resources.


kubectl patch secret YOUR_SECRET -p '{"data":{"key":"NEW_BASE64_ENCODED_VALUE"}}'

You can find more reference here:

I've included more explanation below.

Example of "patching" a secret:

  • $ secret.yaml
apiVersion: v1
kind: Secret
  name: super-secret
  username: a3J1aw==
  password: b2xkLXBhc3N3b3Jk

A side note!

Values of keys like username and password are base64 encoded!

To change the value of password you will need to run:

  • kubectl patch super-secret -p '{"data":{"password":"bmV3LXBhc3N3b3Jk"}}'

Displaying the newly updated secret should show (the output is only partial):

  • $ kubectl get secret super-secret -o yaml
  password: bmV3LXBhc3N3b3Jk 
  username: a3J1aw==

I highly encourage you to check the additional reference:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .