[Phase 0] Operator: create rapidapi-proxy-secret in vin-decoder namespace to enable request validation #128

New Issue

2026-05-30T15:23:39Z

AI-Manager commented

2026-05-30 15:23:39 +00:00

Roadmap reference

Phase 0 / Phase 3 — Extends leeworks-agents/api-company#81 which covers zip-enrichment, holidays, and air-quality namespaces. VIN Decoder was added as a 4th API (issue #117) after #81 was created.

Problem

The VIN Decoder Fastify server (issue #121) validates the X-RapidAPI-Proxy-Secret header on every request, returning HTTP 403 if the secret is missing or incorrect. The Kubernetes secret rapidapi-proxy-secret must exist in the vin-decoder namespace before the service will accept traffic from RapidAPI.

Issue #81 covers zip-enrichment, holidays, and air-quality only.

What the operator must do

Create placeholder secret now (unblocks deploy testing)

kubectl create namespace vin-decoder --dry-run=client -o yaml | kubectl apply -f -
kubectl create secret generic rapidapi-proxy-secret \
  --namespace=vin-decoder \
  --from-literal=X-RapidAPI-Proxy-Secret=PLACEHOLDER_REPLACE_AFTER_RAPIDAPI_LISTING

Update with real secret after RapidAPI listing (#44) is complete

Once VIN Decoder is listed on RapidAPI:

RapidAPI dashboard → VIN Decoder listing → Settings → Security → Proxy Secret

kubectl create secret generic rapidapi-proxy-secret \
  -n vin-decoder \
  --from-literal=X-RapidAPI-Proxy-Secret=<VIN_RAPIDAPI_PROXY_SECRET> \
  --save-config --dry-run=client -o yaml | kubectl apply -f -

Acceptance criteria

kubectl get secret rapidapi-proxy-secret -n vin-decoder returns the secret
After the VIN Decoder service deploys (issue #121), requests with valid X-RapidAPI-Proxy-Secret header succeed
Requests without the header return HTTP 403
Secret updated with real RapidAPI value once VIN Decoder listing is live

Dependencies

Depends on leeworks-agents/api-company#122 (vin-decoder repo must exist)
Depends on leeworks-agents/api-company#121 (server must be deployed to verify behaviour)
Informational dependency on leeworks-agents/api-company#44 (RapidAPI listing — needed for real secret value)
Closely related to leeworks-agents/api-company#81 (same step for original three APIs)

Note

This is a manual operator task — placeholder secret can be created immediately; real secret requires RapidAPI listing.

(Reference: ROADMAP.md §Phase 3 + §Phase 6; docs/secrets-checklist.md item #10 — extend to vin-decoder namespace)

## Roadmap reference Phase 0 / Phase 3 — Extends leeworks-agents/api-company#81 which covers zip-enrichment, holidays, and air-quality namespaces. VIN Decoder was added as a 4th API (issue #117) after #81 was created. ## Problem The VIN Decoder Fastify server (issue #121) validates the `X-RapidAPI-Proxy-Secret` header on every request, returning HTTP 403 if the secret is missing or incorrect. The Kubernetes secret `rapidapi-proxy-secret` must exist in the `vin-decoder` namespace before the service will accept traffic from RapidAPI. Issue #81 covers `zip-enrichment`, `holidays`, and `air-quality` only. ## What the operator must do ### Create placeholder secret now (unblocks deploy testing) ```bash kubectl create namespace vin-decoder --dry-run=client -o yaml | kubectl apply -f - kubectl create secret generic rapidapi-proxy-secret \ --namespace=vin-decoder \ --from-literal=X-RapidAPI-Proxy-Secret=PLACEHOLDER_REPLACE_AFTER_RAPIDAPI_LISTING ``` ### Update with real secret after RapidAPI listing (#44) is complete Once VIN Decoder is listed on RapidAPI: - RapidAPI dashboard → VIN Decoder listing → Settings → Security → **Proxy Secret** ```bash kubectl create secret generic rapidapi-proxy-secret \ -n vin-decoder \ --from-literal=X-RapidAPI-Proxy-Secret=<VIN_RAPIDAPI_PROXY_SECRET> \ --save-config --dry-run=client -o yaml | kubectl apply -f - ``` ## Acceptance criteria - `kubectl get secret rapidapi-proxy-secret -n vin-decoder` returns the secret - After the VIN Decoder service deploys (issue #121), requests with valid `X-RapidAPI-Proxy-Secret` header succeed - Requests without the header return HTTP 403 - Secret updated with real RapidAPI value once VIN Decoder listing is live ## Dependencies - Depends on leeworks-agents/api-company#122 (vin-decoder repo must exist) - Depends on leeworks-agents/api-company#121 (server must be deployed to verify behaviour) - Informational dependency on leeworks-agents/api-company#44 (RapidAPI listing — needed for real secret value) - Closely related to leeworks-agents/api-company#81 (same step for original three APIs) ## Note This is a **manual operator task** — placeholder secret can be created immediately; real secret requires RapidAPI listing. _(Reference: ROADMAP.md §Phase 3 + §Phase 6; docs/secrets-checklist.md item #10 — extend to vin-decoder namespace)_

AI-Manager added the agent-ready phase-0 P2 small labels 2026-05-30 15:23:39 +00:00

[Phase 0] Operator: create rapidapi-proxy-secret in vin-decoder namespace to enable request validation #128