How can I use updatekeys command for all my enctypted files?

[ghost]

Hello

I created a lot of encrypted files.

I going to remove one age key from .sops.yaml file. How can I quickly update all my encrypted files with updatekeys command? I would like to avoid doing it one by one.

sops updatekeys test1.enc.yaml
sops updatekeys test2.enc.yaml
...etc

Thanks

[felixfontein]

I'm using find . \( \( -name '*.sops.yaml' -or -name '*.sops.yml' -or -name '*.sops.json' -or -name '*.sops' \) -and -not \( -name '.sops.yaml' \) \) -print0 | xargs -0L1 sops updatekeys --yes --enable-local-keyservice. You'll have to adjust it to the naming scheme you're using.

[steled]

Hi, I'm using the following command:

for file in $(grep -lr "\"sops\": {"); do sops updatekeys -y $file; done

I'm using the part "sops": { of encrypted files to identify them.

[consideRatio]

I found all files by assuming the start with enc-, and then ran sops updatekeys on them with this terminal command:

find . -type f -name "enc-*" -exec sops updatekeys --yes {} \;

I follow a practice of letting secret files have secret in their name, then they are gitignored - unless they start with enc-, or is some exception. This reduces the risk of exposing a non-encrypted secret file.

# This section handles sensitive content that is or isn't encrypted in our repo.
#
# Ignore files (but not directories) with secret in their name
*secret*
!*secret*/
# Don't ignore enc- prefixed files
!enc-*
# Don't ignore Helm chart templates with secret in their name as
# they are not supposed to contain sensitive content but can often
# have secret in their name.
!**/templates/**/*secret*.yaml