Aller au contenu

Rotate external api key#

Tip

See the nginx-alertreceiver documentation for more details.

Note

In this section, replace the following values as follows:

  • $client_rotate with the name of customer for which we want to rotate the external api key.

The different steps are :

  1. run nginx-alertreceiver configuration with bootstrap mode
  2. communicate external api key to the new customer / only to be done for external sources
  3. redeploy Alertmanager / only to be done for Caascad/NGOT Alertmanagers
  4. cleanup / to do once the source uses the new external api key

These steps are detailed below.

Run nginx-alertreceiver configuration with bootstrap mode#

cd contexts/pf
trackbone apply -z prdcasa -c nginx-alertreceiver -t bootstrap=true -t nginx_alertreceiver_zone_for_bootstrap=$client_rotate

This step will :

  • get internal api key already in Vault
  • generate a new external api key, example : aSSeYS4PFw81oL50Onj4D2gZBXAR4Sek
  • update ingress configuration with new external api key, example : 
     + if ($request_uri = "/alertreceiver/test?apikey=aSSeYS4PFw81oL50Onj4D2gZBXAR4Sek") {
 +   set $code "4059063a0eb75eaaac022eaab3531ee7";
 +   set $cc_client "$client_rotate";
 +   set $resp_body "";
 + }

  • create a new secret in Vault : secret/applications/nginx-alertreceiver/$client_rotate

    Note

    The name of the secret is the timestamp of the creation of the secret.

Communicate external api key to the new customer / only to be done for external sources#

Provides the new customer with the external api key. In our example : aSSeYS4PFw81oL50Onj4D2gZBXAR4Sek.

Redeploy Alertmanager / only to be done for Caascad/NGOT Alertmanagers#

cd contexts/<caascad/ngot>
trackbone apply -z $client_rotate -c alertmanager-cloud-app

This step will Alertmanager configuration uses the new external api key.

Cleanup / to do once the source uses the new external api key#

Warning

To do once the source uses the new external api key.

  • Remove old secret in Vault : check the timestamps
  • Run nginx-alertreceiver configuration : 
    trackbone apply -z prdcasa -c nginx-alertreceiver