diff --git a/aigw/self-hosting/hybrid-deployments/gateway-registration.mdx b/aigw/self-hosting/hybrid-deployments/gateway-registration.mdx index 415823e4..460b8d71 100644 --- a/aigw/self-hosting/hybrid-deployments/gateway-registration.mdx +++ b/aigw/self-hosting/hybrid-deployments/gateway-registration.mdx @@ -71,6 +71,46 @@ The overview page shows: --- +## Rotate the Gateway Authentication Key + +Each registered gateway authenticates to Prisma AIRS AI Gateway with an auth key. Set it as the `PORTKEY_CLIENT_AUTH` value in your deployment. Rotate it from the gateway's overview page, for example after a suspected exposure or on a regular schedule. + + + +Go to **Admin Settings → Gateway Registration** and open the deployment. In the **Gateway Authentication** card, click **Rotate Key**. + + + Gateway Authentication card with a Rotate Key button + + + +Enter a **Grace period (hours)**, from 0 to 24, for how long the previous key keeps working. Leave it empty to use the default. Click **Confirm Rotation**. + + + Rotate key dialog with an optional Grace period in hours and a Confirm Rotation button + + + +Copy the new key and store it in your secret store. It is shown only once. + + + New gateway authentication key shown once, with copy and Done controls + + + +Set `PORTKEY_CLIENT_AUTH` to the new key in each gateway deployment that uses this registration, then restart the gateways. + + +Open the deployment and click **Verify Connection**. Confirm the status is **Active** and **Last Sync** updates. + + + + + Gateways still using the old key stop working once the grace period ends. With a grace period of `0`, the old key stops working immediately and gateways lose sync until you deploy the new key. Pick a grace period long enough to update and restart every gateway. + + +--- + ## Disable the SaaS Gateway The **SaaS Gateway** toggle at the top of the Gateway Registration page controls whether your organisation can send traffic to the Prisma AIRS AI Gateway SaaS gateway. Turn it off to route all traffic through your own registered gateways. diff --git a/aigw/support/rotate-credentials.mdx b/aigw/support/rotate-credentials.mdx index 99c13510..57a121f9 100644 --- a/aigw/support/rotate-credentials.mdx +++ b/aigw/support/rotate-credentials.mdx @@ -242,7 +242,7 @@ Create the new credential at the destination, update the AI Gateway configuratio For [hybrid deployments](/aigw/self-hosting/hybrid-deployments/architecture), rotate every secret in your deployment configuration: -- **`PORTKEY_CLIENT_AUTH`**: the credential your gateway uses to sync with the AI Gateway control plane. Contact Palo Alto Networks support to have it reissued, then update your deployment and restart the gateway. +- **`PORTKEY_CLIENT_AUTH`**: the credential your gateway uses to sync with the AI Gateway control plane. Rotate it yourself: open the deployment under **Admin Settings → Gateway Registration**, click **Rotate Key**, set a grace period, and copy the new key. To cut off a possibly exposed key, use a grace period of `0` or a few hours. Then update your deployment and restart the gateway. See [Rotate the Gateway Authentication Key](/aigw/self-hosting/hybrid-deployments/gateway-registration#rotate-the-gateway-authentication-key). - **Log store credentials:** for example `LOG_STORE_ACCESS_KEY` and `LOG_STORE_SECRET_KEY` (S3, GCS HMAC, or Azure storage). - **Cache and database credentials:** Redis, and any database your deployment uses. - **Provider keys and other values in your environment files, Helm values, or Kubernetes secrets.** diff --git a/images/self-hosting/gateway-auth-grace-period.png b/images/self-hosting/gateway-auth-grace-period.png new file mode 100644 index 00000000..79cdd8b4 Binary files /dev/null and b/images/self-hosting/gateway-auth-grace-period.png differ diff --git a/images/self-hosting/gateway-auth-new-key.png b/images/self-hosting/gateway-auth-new-key.png new file mode 100644 index 00000000..312708f2 Binary files /dev/null and b/images/self-hosting/gateway-auth-new-key.png differ diff --git a/images/self-hosting/gateway-auth-rotate-key.png b/images/self-hosting/gateway-auth-rotate-key.png new file mode 100644 index 00000000..90ba6adb Binary files /dev/null and b/images/self-hosting/gateway-auth-rotate-key.png differ diff --git a/self-hosting/hybrid-deployments/gateway-registration.mdx b/self-hosting/hybrid-deployments/gateway-registration.mdx index 8f54c546..0cbf69c2 100644 --- a/self-hosting/hybrid-deployments/gateway-registration.mdx +++ b/self-hosting/hybrid-deployments/gateway-registration.mdx @@ -80,6 +80,46 @@ The overview page shows: --- +## Rotate the Gateway Authentication Key + +Each registered gateway authenticates to Portkey with an auth key. Set it as the `PORTKEY_CLIENT_AUTH` value in your deployment. Rotate it from the gateway's overview page, for example after a suspected exposure or on a regular schedule. + + + +Go to **Admin Settings → Gateway Registration** and open the deployment. In the **Gateway Authentication** card, click **Rotate Key**. + + + Gateway Authentication card with a Rotate Key button + + + +Enter a **Grace period (hours)**, from 0 to 24, for how long the previous key keeps working. Leave it empty to use the default. Click **Confirm Rotation**. + + + Rotate key dialog with an optional Grace period in hours and a Confirm Rotation button + + + +Copy the new key and store it in your secret store. It is shown only once. + + + New gateway authentication key shown once, with copy and Done controls + + + +Set `PORTKEY_CLIENT_AUTH` to the new key in each gateway deployment that uses this registration, then restart the gateways. + + +Open the deployment and click **Verify Connection**. Confirm the status is **Active** and **Last Sync** updates. + + + + + Gateways still using the old key stop working once the grace period ends. With a grace period of `0`, the old key stops working immediately and gateways lose sync until you deploy the new key. Pick a grace period long enough to update and restart every gateway. + + +--- + ## Disable the SaaS Gateway The **SaaS Gateway** toggle at the top of the Gateway Registration page controls whether your organisation can send traffic to the Portkey SaaS gateway. Turn it off to route all traffic through your own registered gateways. diff --git a/support/rotate-credentials.mdx b/support/rotate-credentials.mdx index b72d442d..53621ccc 100644 --- a/support/rotate-credentials.mdx +++ b/support/rotate-credentials.mdx @@ -229,7 +229,7 @@ Create the new credential at the destination, update the Portkey configuration, For [hybrid deployments](/self-hosting/hybrid-deployments/architecture), rotate every secret in your deployment configuration: -- **`PORTKEY_CLIENT_AUTH`**: the credential your gateway uses to sync with the Portkey control plane. Contact [Portkey support](/support/contact-us) to have it reissued, then update your deployment and restart the gateway. +- **`PORTKEY_CLIENT_AUTH`**: the credential your gateway uses to sync with the Portkey control plane. Rotate it yourself: open the deployment under **Admin Settings → Gateway Registration**, click **Rotate Key**, set a grace period, and copy the new key. To cut off a possibly exposed key, use a grace period of `0` or a few hours. Then update your deployment and restart the gateway. See [Rotate the Gateway Authentication Key](/self-hosting/hybrid-deployments/gateway-registration#rotate-the-gateway-authentication-key). - **Log store credentials:** for example `LOG_STORE_ACCESS_KEY` and `LOG_STORE_SECRET_KEY` (S3, GCS HMAC, or Azure storage). - **Cache and database credentials:** Redis, and any database your deployment uses. - **Provider keys and other values in your environment files, Helm values, or Kubernetes secrets.**