REL-850418: Add rotate-api-key user guide for Environment Watch#69
REL-850418: Add rotate-api-key user guide for Environment Watch#69amithshet wants to merge 3 commits into
Conversation
Documents all CLI use cases for the rotate-api-key command including interactive, cluster-targeted, quiet, dry-run, and invalid cluster scenarios, with supporting screenshots for both the InfraWatch and DataGrid clusters. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…idence Replaces all screenshots (except Dev Tools invalidated key verification) with images from the July 12 feedback doc. Adds interactive mode screenshots and covers dry-run, quiet mode, cluster flag, and short alias use cases. Removes Secret Store and Kibana before/after screenshots not in the feedback evidence, consolidating Kibana verification into a single combined image. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Transcribes all command-prompt screenshots into rendered code blocks matching the project documentation style. Removes the eight CLI PNG files from resources. Kibana and Dev Tools verification screenshots are retained. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
dinesh1010101
left a comment
dinesh1010101
left a comment
There was a problem hiding this comment.
@amithshet Once Api-Key is rotated, does Audit were working without any service restart?
@dinesh1010101 , no, it requires Elasticsearch service restarts. |
Thanks for the info, is this added somewhere in documentation i haven't notice this info? Coming to Audit, are you saying it works if elasticsearch is restarted? Do we know why elasticsearch restart is required, normally for Api-Key no restart will be required. Also, what's the trigger point for customer to follow this page? Usually i think when customer api-key expires, they have to come to this page, so technically, there has to be some content in troubleshooting page which navigates to this new page. |
anujavinash
left a comment
anujavinash
left a comment
There was a problem hiding this comment.
Documentation review against the live implementation in server-relativity-environmentwatch. Found four issues: one correctness bug (copyright year), one UX gap (quiet mode description), one outdated term, and one missing output snippet. All findings are anchored to specific lines and verified against the source code.
| ## Prerequisites | ||
|
|
||
| - The Server-bundle zip file has been downloaded and extracted to `C:\Server.Bundle.x.y.z` | ||
| - Access to the Relativity Secret Store (whitelisted for Secret Store access) |
There was a problem hiding this comment.
Outdated terminology: whitelisted → allowlisted
The word "whitelisted" is flagged by Relativity's inclusive-language standard. The codebase itself already uses "allowlist" (see CHANGELOG.md). Suggest:
- Allowlisted for Secret Store access
or simply:
- Has access to the Relativity Secret Store
| | Flag | Short alias | Description | Default | | ||
| |------|-------------|-------------|---------| | ||
| | `--cluster <value>` | `-c` | Target Elasticsearch cluster. Valid values: `rel-cluster-infrawatch`, `rel-cluster-datagrid` | Prompted interactively | | ||
| | `--quiet` | | Suppress all prompts, auto-confirm, and use the default 180-day expiry | `false` | |
There was a problem hiding this comment.
--quiet description overstates what the flag suppresses alone
The current description says "Suppress all prompts, auto-confirm, and use the default 180-day expiry", but per RotateApiKeyTask.cs (lines 178–188), the cluster selection prompt (SelectAsync) is not gated on QuietMode — it still appears when --cluster is omitted. Only the confirmation and expiry prompts are suppressed.
This table row can mislead users into thinking --quiet alone will run fully unattended. The "Quiet mode" section prose correctly shows the two flags together, but the table should match. Suggested description:
Suppress confirmation and expiry prompts; auto-confirms with the default 180-day expiry. Use together with --cluster for fully unattended execution.
| C:\Server.Bundle.x.y.z\relsvr.exe rotate-api-key | ||
| Relativity Server CLI - 100.0.28 | ||
| Copyright (c) 2025, Relativity ODA LLC |
There was a problem hiding this comment.
Copyright year is wrong in all CLI output examples
Program.cs line 214 hardcodes:
consoleWrapper.WriteLine("Copyright (c) 2026, Relativity ODA LLC");Every code block in this document shows Copyright (c) 2025, Relativity ODA LLC. The year appears in seven places: lines 35, 79, 95, 109, 128, 143, and 161. All need to be updated to 2026.
This will be the first thing a user notices when they compare the docs to the actual terminal output.
| rel-cluster-datagrid | ||
| ``` | ||
|
|
||
| After selecting a cluster, the CLI displays the current API key ID and the number of days remaining before expiry, then asks you to confirm the rotation. Entering `n` aborts with no changes made. Entering `y` continues to prompt for a validity period in days, then performs the rotation. |
There was a problem hiding this comment.
Missing terminal output for the n (abort) path
The prose says "Entering n aborts with no changes made" but doesn't show what the terminal actually prints. Per Strings.RotateApiKeyAbortedMessage and RotateApiKeyTask.cs line 270, the CLI outputs:
Key rotation aborted. No changes were made.
Consider adding a collapsed code block showing the n path so users know exactly what to expect (and can grep/search for it if they see it in logs).
3 participants
Summary
elastic-stack-rotate-api-key-environment-watch.mddocumenting allrotate-api-keyCLI use cases: interactive,--cluster,-cshort alias,--quiet,--dryrun, and invalid cluster errorTest plan
RotateApiKey-Kibana-After.png,RotateApiKey-InfraWatch-DevTools-OldKey.png,RotateApiKey-InfraWatch-DevTools-NewKey.png)elastic-stack-setup-02-environment-watch.mdandrelativity-server-cli.mdresolve🤖 Generated with Claude Code