agent failed to decrypt the sops file: age key expired mid-run
Fixes an agent failing to decrypt a sops file when the age key expired mid-run: use short-lived keys with re-issue. Use when long agent runs outlive their decryption keys. Not for wrong-key errors.
TL;DR
Long-running agents outlive short-lived age keys, so decryption fails halfway. Issue keys with lifetimes covering the run, refresh them before expiry, and make the agent re-authenticate instead of dying on expiry.
Error
agent failed to decrypt the sops file: age key expired mid-runSteps
- Confirm the failure is expiry: the key worked at run start and fails later. Expected: expiry, not a wrong key.
- Size key lifetimes to the longest expected run plus margin. Expected: keys outlive runs.
- Add a refresh step before the known expiry point in long runs. Expected: no mid-run expiry.
- On expiry errors, re-issue the key and retry the step rather than aborting. Expected: the run continues.
- Log key issuance and expiry so the next failure is diagnosable. Expected: clear audit trail.
When to use
- Agent runs failing on age key expiry mid-run.
- Designing long-lived automation with sops.
When not to use
- Wrong-key errors (fix the key, not the lifetime).
- Short runs (expiry is not the cause).
Tool compatibility
- Sops with age; agent orchestration.
Variant phrasings
age key expired during run
Refresh before expiry.
sops decrypt failed halfway
Same lifetime fix.
Why it happens
Ephemeral keys are a security feature; agents that run longer than the key lifetime hit the designed expiry.
Edge cases
- Refresh needs the issuing authority reachable; cache a fallback.
- Concurrent steps sharing one key race on refresh; coordinate.
- Expiry during a write can corrupt output; make writes atomic.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_PmwURof7v57Wyq6S48nfHw