diff --git a/.env.example b/.env.example index 54ec44e51a..713746a39a 100644 --- a/.env.example +++ b/.env.example @@ -83,11 +83,17 @@ S3_SCRAPER_BUCKET=dummy-scraper-bucket # Bucket holding the per-env redirect overlays (spacecat--aso-overlays), # read by RedirectsController with the Lambda's own execution role. The API key # is the inbound X-ASO-API-Key the dispatcher sends (same value Fastly checks). -# Both Vault-backed in prod under dx_mysticat//api-service: -# vault kv get -field=S3_ASO_OVERLAYS_BUCKET dx_mysticat//api-service -# vault kv get -field=ASO_OVERLAY_API_KEY dx_mysticat//api-service +# ASO_OVERLAY_API_KEY_PREVIOUS is empty in steady state and populated during +# key rotation to accept the previous key alongside the current one — the +# handler falls back to it when the current key doesn't match, so dispatcher +# pods still holding the old value are not 401'd during EVO propagation. +# All Vault-backed in prod under dx_mysticat//api-service: +# vault kv get -field=S3_ASO_OVERLAYS_BUCKET dx_mysticat//api-service +# vault kv get -field=ASO_OVERLAY_API_KEY dx_mysticat//api-service +# vault kv get -field=ASO_OVERLAY_API_KEY_PREVIOUS dx_mysticat//api-service S3_ASO_OVERLAYS_BUCKET=dummy-aso-overlays-bucket ASO_OVERLAY_API_KEY=dummy-aso-overlay-key +ASO_OVERLAY_API_KEY_PREVIOUS= # ── Scrape client (eagerly parsed in constructor) ───────────────────────────── SCRAPE_JOB_CONFIGURATION={"queues":[],"scrapeWorkerQueue":"https://sqs.us-east-1.amazonaws.com/000000000000/dummy-scrape","s3Bucket":"dummy-scrape-bucket","options":{},"maxUrlsPerJob":4000,"maxUrlsPerMessage":1000,"scrapeQueueUrlPrefix":"https://sqs.us-east-1.amazonaws.com/000000000000/dummy"}