Allow passing into the crypto key via ASTRO_KEY #11879
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
🦋 Changeset detectedLatest commit: c7c8cd8 The changes in this PR will be included in the next version bump. Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
github-actions
bot
added
the
pkg: astro
|
!preview crypto-env |
|
Snapshots have been released for the following packages:
Publish LogBuild Log |
|
I've tested this at least five times by generating an AES-256 key and adding this to package.json: "build": ASTRO_KEY=MY_KEY astro buildThe application was then built with, npm run buildand deployed to a kubernetes cluster. I did not see any of the errors I've seen before during deploys, so this should fix the issue I had with rolling updates. Thank you for fixing this so quickly. |
|
Thanks @sasoria, I still need to write a test so this probably won't go out today. |
ascorbic
reviewed
Sep 6, 2024
| if(!hasKey && opts.settings.config.experimental.serverIslands) { | ||
| this.logger.info('build', `This build generated a key to encrypt props passed to Server islands. To reuse the same key across builds, set this value as ASTRO_KEY in an environment variable on your build server. | ||
|
|
||
| ASTRO_KEY=${await encodeKey(await keyPromise)} |
There was a problem hiding this comment.
Is it safe to print this? I'd be worried it would show in public logs
There was a problem hiding this comment.
Ah yeah good point. Hm, I'm not sure what to do then. The only other way I can think to do this is with a new command. Something like astro generate-key or something.
There was a problem hiding this comment.
That's probably a better way to go. Will update the PR.
There was a problem hiding this comment.
New output is like:
Generated a key to encrypt props passed to Server islands. To reuse the same key across builds, set this value as ASTRO_KEY in an environment variable on your build server.
ASTRO_KEY=P90X3r0+nEqzystDC1pg01VS4s/+jINyDTYSNlEO0HQ=
There was a problem hiding this comment.
I like it. Not a blocker, but I wonder if it would make sense to write it to the user's .env if there isn't already one set.
ascorbic
approved these changes
Sep 6, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
This makes it possible to pass in the cryptography used via the ASTRO_KEY environment variable.
This allows you to reuse the key in each build, ensuring that if you have separate server and client deployments that the keys are never out of sync.
Fixes Astro Islands fails with rolling update #11851
Keys are generated using
astro create-keycommand.Testing
Docs
N/A