From 923c54136ef878467409b965942872f97f02e979 Mon Sep 17 00:00:00 2001 From: Abhishek Garg Date: Mon, 13 Jul 2026 13:32:03 +0530 Subject: [PATCH] chore(aso-overlay): document ASO_OVERLAY_API_KEY_PREVIOUS in .env.example MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Non-blocking follow-up from Alina's review of PR #2663 (dual-key overlap for API key rotation): the handler already accepts ASO_OVERLAY_API_KEY_PREVIOUS as the previous-key fallback, but the env var was undocumented in the example file, so local devs had no signal it exists. Empty in steady state; operators populate it during a rotation window (populating both aso_keys_previous at Fastly and ASO_OVERLAY_API_KEY_PREVIOUS here in lockstep — see spacecat-infrastructure#627 MIGRATION-lite-e.md for the rotation flow) so dispatcher pods still holding the old key are not 401'd during EVO propagation. Co-Authored-By: Claude --- .env.example | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/.env.example b/.env.example index 54ec44e51a..713746a39a 100644 --- a/.env.example +++ b/.env.example @@ -83,11 +83,17 @@ S3_SCRAPER_BUCKET=dummy-scraper-bucket # Bucket holding the per-env redirect overlays (spacecat--aso-overlays), # read by RedirectsController with the Lambda's own execution role. The API key # is the inbound X-ASO-API-Key the dispatcher sends (same value Fastly checks). -# Both Vault-backed in prod under dx_mysticat//api-service: -# vault kv get -field=S3_ASO_OVERLAYS_BUCKET dx_mysticat//api-service -# vault kv get -field=ASO_OVERLAY_API_KEY dx_mysticat//api-service +# ASO_OVERLAY_API_KEY_PREVIOUS is empty in steady state and populated during +# key rotation to accept the previous key alongside the current one — the +# handler falls back to it when the current key doesn't match, so dispatcher +# pods still holding the old value are not 401'd during EVO propagation. +# All Vault-backed in prod under dx_mysticat//api-service: +# vault kv get -field=S3_ASO_OVERLAYS_BUCKET dx_mysticat//api-service +# vault kv get -field=ASO_OVERLAY_API_KEY dx_mysticat//api-service +# vault kv get -field=ASO_OVERLAY_API_KEY_PREVIOUS dx_mysticat//api-service S3_ASO_OVERLAYS_BUCKET=dummy-aso-overlays-bucket ASO_OVERLAY_API_KEY=dummy-aso-overlay-key +ASO_OVERLAY_API_KEY_PREVIOUS= # ── Scrape client (eagerly parsed in constructor) ───────────────────────────── SCRAPE_JOB_CONFIGURATION={"queues":[],"scrapeWorkerQueue":"https://sqs.us-east-1.amazonaws.com/000000000000/dummy-scrape","s3Bucket":"dummy-scrape-bucket","options":{},"maxUrlsPerJob":4000,"maxUrlsPerMessage":1000,"scrapeQueueUrlPrefix":"https://sqs.us-east-1.amazonaws.com/000000000000/dummy"}