Vault enabled Store

[materialsproject]

Vault enabled Store

[mkhorton]

I started working on this a while back but stalled .. is the vault service on matgen8 still running? I can see the gui but can't seem to login via a github token, and I used to be able to

[shreddd]

picking this up

[shreddd]

shyamd [10:27 AM]
inherit from Mongo
MongoStore
and make a new init
that can grab all the credentials

mkhorton [10:30 AM]
and yes .. something like

class VaultMongoStore(MongoStore):   
  
    def __init__(vault_key='key_for_a_specific_credential'): # lookup credential from vault        
       super.__init__(...with vault credentials...)

[shreddd]

@mkhorton - how does the user pass in vault config? Specifically, I need the

• vault_host
• vault_secret_path
• vault_token

I'm currently just defining these as args to init but it would be good to think about how this is configured.

[shyamd]

We thought these might be environment variables or read in default locations? This is something where your insight in a balance of security/accessibility would be useful.

[mkhorton]

This hasn't been written yet, so however you think is best?

Personally I think the vault_token should be an env variable as @shyamd says, rather than a kwarg. Because kwarg arguments might get serialized somewhere. And probably makes sense to set the vault_host as an env variable too, because we'll only have one vault host, so we can set it and forget it.

vault_secret_path is probably what we want as the init arg to VaultMongoStore() though

[mkhorton]

The point is that the secret paths aren't sensitive/shouldn't be treated as secrets themselves, since they are what we'll distribute to people to help them get connected, so using those as the input arg to VaultMongoStore is fine (and helpful!).

[shreddd]

OK - Mongostore also expects there to be a collection_name - would this be passed in as well?

[shyamd]

That should probably be passed in with the secret path

[mkhorton]

+1

[shreddd]

OK - See https://github.com/materialsproject/maggma/tree/issue_8_vault_store for a proposed implementation

I wanted to check if this is the approximate API you want. Not quite sure how to test though!

[shreddd]

Also - Should this live in advanced_stores.py or stores.py?

[shyamd]

I think advanced Stores is the appropriate spot for it.