Skip to content

REL-850418: Add rotate-api-key user guide for Environment Watch#69

Open
amithshet wants to merge 6 commits into
mainfrom
REL-850418-cli-rotate-api-key
Open

REL-850418: Add rotate-api-key user guide for Environment Watch#69
amithshet wants to merge 6 commits into
mainfrom
REL-850418-cli-rotate-api-key

Conversation

@amithshet

@amithshet amithshet commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • Adds elastic-stack-rotate-api-key-environment-watch.md documenting all rotate-api-key CLI use cases: interactive, --cluster, -c short alias, --quiet, --dryrun, and invalid cluster error
  • Includes CLI output as rendered code blocks and retains Kibana + Elasticsearch Dev Tools screenshots for the verification section
  • Screenshots sourced from July 12 feedback evidence

Test plan

  • Review rendered markdown in GitHub to confirm code blocks and screenshots display correctly
  • Verify all image references resolve (RotateApiKey-Kibana-After.png, RotateApiKey-InfraWatch-DevTools-OldKey.png, RotateApiKey-InfraWatch-DevTools-NewKey.png)
  • Confirm links to elastic-stack-setup-02-environment-watch.md and relativity-server-cli.md resolve

🤖 Generated with Claude Code

amithshet and others added 3 commits July 20, 2026 21:57
@amithshet @claude
REL-850418: Add rotate-api-key user guide for Environment Watch
970112f 
Documents all CLI use cases for the rotate-api-key command including
interactive, cluster-targeted, quiet, dry-run, and invalid cluster
scenarios, with supporting screenshots for both the InfraWatch and
DataGrid clusters.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@amithshet @claude
REL-850418: Update rotate-api-key screenshots with latest feedback ev…
1054acd 
…idence

Replaces all screenshots (except Dev Tools invalidated key verification)
with images from the July 12 feedback doc. Adds interactive mode screenshots
and covers dry-run, quiet mode, cluster flag, and short alias use cases.
Removes Secret Store and Kibana before/after screenshots not in the feedback
evidence, consolidating Kibana verification into a single combined image.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@amithshet @claude
REL-850418: Replace CLI screenshots with code blocks
031b50b 
Transcribes all command-prompt screenshots into rendered code blocks
matching the project documentation style. Removes the eight CLI PNG
files from resources. Kibana and Dev Tools verification screenshots
are retained.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@amithshet
amithshet requested a review from a team as a code owner July 20, 2026 16:42
dinesh1010101
dinesh1010101 reviewed Jul 21, 2026
View reviewed changes

@dinesh1010101 dinesh1010101 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@amithshet Once Api-Key is rotated, does Audit were working without any service restart?

@amithshet

amithshet commented Jul 22, 2026

Copy link
Copy Markdown
Collaborator Author

@amithshet Once Api-Key is rotated, does Audit were working without any service restart?

@dinesh1010101 , no, it requires Elasticsearch service restarts.

@dinesh1010101

dinesh1010101 commented Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

@amithshet Once Api-Key is rotated, does Audit were working without any service restart?

@dinesh1010101 , no, it requires Elasticsearch service restarts.

Thanks for the info, is this added somewhere in documentation i haven't notice this info?

Coming to Audit, are you saying it works if elasticsearch is restarted? Do we know why elasticsearch restart is required, normally for Api-Key no restart will be required.

Also, what's the trigger point for customer to follow this page? Usually i think when customer api-key expires, they have to come to this page, so technically, there has to be some content in troubleshooting page which navigates to this new page.

anujavinash
anujavinash reviewed Jul 22, 2026
View reviewed changes

@anujavinash anujavinash left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Documentation review against the live implementation in server-relativity-environmentwatch. Found four issues: one correctness bug (copyright year), one UX gap (quiet mode description), one outdated term, and one missing output snippet. All findings are anchored to specific lines and verified against the source code.

Comment thread ...p/elastic-stack-setup-02-environment-watch/elastic-stack-rotate-api-key-environment-watch.md Outdated
Comment thread ...p/elastic-stack-setup-02-environment-watch/elastic-stack-rotate-api-key-environment-watch.md Outdated
Comment thread ...p/elastic-stack-setup-02-environment-watch/elastic-stack-rotate-api-key-environment-watch.md Outdated
Comment thread ...p/elastic-stack-setup-02-environment-watch/elastic-stack-rotate-api-key-environment-watch.md Outdated
@amithshet @claude
REL-850418: Address PR feedback from code review
39e1fb8 
- Fix --quiet options table description to accurately reflect that only
  confirmation and expiry prompts are suppressed (not cluster selection)
- Add abort output snippet for the interactive n-path
- Revert Secret Store prerequisite to match sibling doc wording

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@amithshet

amithshet commented Jul 22, 2026

Copy link
Copy Markdown
Collaborator Author

Thanks for the review @anujavinash! Here's what was addressed:

Finding 2 — --quiet table description ✅ Applied
Updated the Options table to accurately reflect that --quiet only suppresses confirmation and expiry prompts, not the cluster selection prompt. Added a note to use it together with --cluster for fully unattended execution.

Finding 4 — Missing abort output ✅ Applied
Added the Key rotation aborted. No changes were made. code block inline in the Interactive section so users can see the exact terminal output when entering n.

Finding 1 — whitelisted terminology ❌ Not applied
Kept the existing wording (Whitelisted for Secret Store access) to stay consistent with the sibling docs in the same directory (elastic-stack-setup-02-environment-watch.md, ew-01-install-monitoring-agents.md). Updating inclusive language across all docs is a separate effort.

Finding 3 — Copyright year 2025 → 2026 ❌ Not applied
This is a known behaviour in the codebase and is intentionally left as-is.

@amithshet @claude
REL-850418: Address code review feedback from JSP Code-Reviewer and C…
ed48c9d 
…laude

Addressed the following items identified during code review:

- Title corrected from plural "Keys" to singular "an Elasticsearch API Key"
  to accurately reflect that each command invocation rotates one key
- Secret Store verification reworded to instruct reading the secret both
  before and after rotation, removing the assumption that a baseline was
  already captured
- Kibana verification step updated from "approximately six months" to
  "approximately 180 days" for consistency with the rest of the document
- External Secret Store help link updated from Server2024 to Server2025
  to match the version referenced across the rest of the repo
- CLI version banner updated across all code examples from 100.0.28 /
  Copyright (c) 2025 to 102.1.18 / Copyright (c) 2026

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
anujavinash
anujavinash approved these changes Jul 22, 2026
View reviewed changes

@anujavinash anujavinash left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@amithshet
Screenshot having API Keys are local created. As per me no security concern.
Approving the PR
cc: @satishdayala-relativity

@amithshet @claude
REL-850418: Add API key rotation guidance and DataGrid/EW troubleshoo…
75b92b0 
…ting docs

- elastic-stack-setup-03-audit.md: Added 'API Key Expiry and Rotation' section
  with the rotate-api-key command for the DataGrid cluster and a link to the
  full rotate-api-key guide and the new DataGrid audit troubleshooting guide.
- datagrid-audit-troubleshooting.md (new): Documents the two-stage failure
  sequence after DataGrid API key rotation — auth error resolved by restarting
  kCura services, followed by 'no results' resolved by restarting Elasticsearch
  and waiting 1-5 minutes before reloading the Audit tab.
- monitoring-agent-and-otel-collector.md: Added 'Environment Watch Not Working
  After API Key Rotation' section — restart EW Windows service, wait 2-5 min;
  if unresolved, restart Elasticsearch, Kibana, and APM Server.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@anujavinash anujavinash anujavinash approved these changes
@deepankarrelativity002 deepankarrelativity002 Awaiting requested review from deepankarrelativity002
@satishdayala-relativity satishdayala-relativity Awaiting requested review from satishdayala-relativity
@Rahiman-Nadaf Rahiman-Nadaf Awaiting requested review from Rahiman-Nadaf
@Chaitan2681 Chaitan2681 Awaiting requested review from Chaitan2681
@dinesh1010101 dinesh1010101 Awaiting requested review from dinesh1010101

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@amithshet @dinesh1010101 @anujavinash