feat(mitxonline): add MIT_LEARN_FASTLY_SERVICE_ID to k8s secrets - #5158
Merged
Conversation
The mitxonline Fastly surrogate-key purge must target MIT Learn's Fastly
service (MIT Learn tags product-page responses with the mitxonline:*
surrogate keys), not MITxOnline's own service. Add a new
MIT_LEARN_FASTLY_SERVICE_ID env var, sourced per-environment from a new
fastly.mit_learn_service_id key in each mitxonline SOPS secrets file
(values copied from learn_service_id_{ci,qa,production} under
infrastructure/fastly in operations.production.yaml).
Supports mitodl/mitxonline#3794.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new per-environment Fastly service ID (MIT Learn’s) into the MITxOnline Kubernetes static secrets so the application can target the correct Fastly service when issuing surrogate-key purges (supporting mitodl/mitxonline#3794).
Changes:
- Expose
MIT_LEARN_FASTLY_SERVICE_IDvia the existingmitxonline-collected-static-secretVault-agent templated secret. - Add
fastly.mit_learn_service_idto the mitxonline SOPS secrets files forci,qa, andproduction.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| src/ol_infrastructure/applications/mitxonline/k8s_secrets.py | Adds MIT_LEARN_FASTLY_SERVICE_ID to the Vault-agent template set used for the collected static K8s Secret. |
| src/bridge/secrets/mitxonline/secrets.ci.yaml | Adds encrypted fastly.mit_learn_service_id for CI. |
| src/bridge/secrets/mitxonline/secrets.qa.yaml | Adds encrypted fastly.mit_learn_service_id for QA. |
| src/bridge/secrets/mitxonline/secrets.production.yaml | Adds encrypted fastly.mit_learn_service_id for production. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What are the relevant tickets?
Supports mitodl/mitxonline#3794
Description (What does it do?)
Supplies the mitxonline deployment with a new
MIT_LEARN_FASTLY_SERVICE_IDenvironment variable, per environment.mitxonline PR mitodl/mitxonline#3794 fixes a Fastly surrogate-key purge that was a no-op. The purge must target MIT Learn's Fastly service — MIT Learn is what tags product-page responses with the
mitxonline:*surrogate keys — but the code had been using MITxOnline's own service ID. The app now readsMIT_LEARN_FASTLY_SERVICE_IDand passes it explicitly intoqueue_fastly_surrogate_key_purge.Changes:
src/ol_infrastructure/applications/mitxonline/k8s_secrets.py: addsMIT_LEARN_FASTLY_SERVICE_IDto thecollectedstatic-secret templates (rendered by the Vault agent from thesecret-mitxonlinemount, pathcollected-static-secrets), sourcingfastly.mit_learn_service_id. It rides the existingmitxonline-collected-static-secretK8s Secret, already consumed by the deployment viaenvFrom, so no__main__.pychange is needed.src/bridge/secrets/mitxonline/secrets.{ci,qa,production}.yaml: adds a newfastly.mit_learn_service_idkey to each env's SOPS file, alongside the existingapi_key/service_id.Why copy the values instead of reading them in place: the correct MIT Learn service IDs already exist as
learn_service_id_{ci,qa,production}underinfrastructure/fastlyinsrc/bridge/secrets/concourse/operations.production.yaml, but those are loaded tosecret-concourse/infrastructure/fastlyonly by the production Concourse stack — so they live only in the production Vault. mitxonline ci/qa/production each deploy against separate Vaults and read from thesecret-mitxonlinemount, so the value has to live in each env's own mitxonline SOPS file to work per-environment.operations.production.yamlis the source of truth the values were copied from.The existing
MITX_ONLINE_FASTLY_SERVICE_ID/fastly.service_id(MITxOnline's own service) is left untouched.FASTLY_SERVICE_IDis intentionally not restored — nothing reads it.How can this be tested?
pre-commit run --files <changed files>passes (ruff, mypy, detect-secrets, yaml/sops checks).sops --decrypt src/bridge/secrets/mitxonline/secrets.<env>.yaml | grep -A3 '^fastly:'showsmit_learn_service_idwith the correct per-env value for ci/qa/production.pulumi previewper stack (CI first) fromsrc/ol_infrastructure/applications/mitxonline: expect themitxonline-collected-static-secretto add theMIT_LEARN_FASTLY_SERVICE_IDtemplate key and the Vaultcollected-static-secretssecret to gain themit_learn_service_idfield.kubectl exec <mitxonline-pod> -n <ns> -- printenv MIT_LEARN_FASTLY_SERVICE_IDreturns MIT Learn's service ID and differs fromMITX_ONLINE_FASTLY_SERVICE_ID.Checklist:
purge_selectauthorization on MIT Learn's Fastly service (called out in fix: read Learn's Fastly service ID from MIT_LEARN_FASTLY_SERVICE_ID mitxonline#3794).