Agentic Data Plane

rpk ai secret update

Update a secret. Only the values you pass change.

You can pass any of the following:

  • --value or --value-file: Replace the value. Omit both to keep the stored value.

  • --tag KEY=VALUE: Add or overwrite a tag.

  • --remove-tag KEY: Remove a tag.

A tag change reads the secret first and sends the merged tag set. If another edit changes the secret in between, the update fails instead of overwriting that edit. A value-only update doesn’t read the secret first.

This command was introduced in ai version 0.2.92.

Usage

rpk ai secret update [flags]

Examples

This section provides examples of how to use rpk ai secret update.

printf %s "$NEW_KEY" | rpk ai secret update OPENAI_API_KEY --value-file -
rpk ai secret update OPENAI_API_KEY --tag env=prod --remove-tag stale

Flags

Value Type Description

--remove-tag

stringArray

tag key to remove (repeatable).

--tag

stringArray

tag to add or overwrite, KEY=VALUE (repeatable).

--value

string

secret value, inline. Visible in shell history and the process list; prefer --value-file.

--value-file

string

read the secret value from a file, or "-" for stdin. One trailing newline is stripped.

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.