Secrets

Secrets

class runhouse.Secrets[source]

Handles cluster secrets management (reading and writing) across all major cloud providers. Secrets are securely stored in Hashicorp Vault.

classmethod builtin_providers(as_str: bool = False) → list[source]

Return list of all Runhouse providers (as class objects) supported out of the box.

classmethod delete_from_local_env(providers: Optional[List[str]] = None)[source]

Delete secrets credential files and use in Runhouse configs for list of specified providers. If none are provided, will delete secrets for all providers which have been enabled in the local environment.

Example

>>> rh.Secrets.delete_from_local_env(provider=["lambda"])

Copied

classmethod delete_from_vault(providers: Optional[List[str]] = None)[source]

Delete secrets from Vault for specified providers.

Parameters:

providers (List[str] or None) – Providers to delete from vault. If not set, will delete secrets for all providers which have been enabled in the local environment.

Example

>>> rh.Secrets.delete_from_vault()

Copied

classmethod delete_secrets_file(file_path: Optional[Union[str, tuple]] = None)[source]

Delete local credentials file. If no path is provided will use the default path set for the provider.

Example

>>> rh.Secrets.delete_secrets_file()
>>> rh.Secrets.delete_secrets_file("~/.aws/credentials")

Copied

classmethod download_into_env(save_locally: bool = True, providers: Optional[List[str]] = None, headers: Optional[Dict] = None, check_enabled: bool = True) → Dict[source]

Get all user secrets from Vault. Optionally save them down to local config files (where relevant).

Example

>>> rh.Secrets.download_into_env(providers=["aws", "lambda"])

Copied

classmethod enabled_providers(as_str: bool = False) → List[source]

Returns a list of cloud provider classes which Runhouse supports out of the box. If as_str is True, return the names of the providers as strings.

Example

>>> rh.Secrets.enabled_providers(as_str=True)

Copied

classmethod extract_and_upload(headers: Optional[Dict] = None, interactive=False, providers: Optional[List[str]] = None)[source]

Upload all locally configured secrets into Vault. Secrets are loaded from their local config files. (ex: ~/.aws/credentials). To upload custom secrets for custom providers, see Secrets.put()

Example

>>> rh.Secrets.extract_and_upload(providers=["aws", "lambda"])

Copied

classmethod get(provider: str, save_to_env: bool = False, group: Optional[str] = None) → dict[source]

Read secrets from the Vault service for a given provider and optionally save them to their local config. If group is provided will read secrets for the specified group.

Example

>>> rh.get(provider="lambda")
>>> # returns {"api_key": *****}

Copied

classmethod load_provider_secrets(from_env: bool = False, providers: Optional[List] = None) → Dict[str, Dict][source]

Load secret credentials for all the providers which have been configured locally, or optionally provide a list of specific providers to load. Returns a dictionary with provider name as the key and secrets dictionary as value.

Example

>>> rh.Secrets.load_provider_secrets(providers=["aws"])

Copied

classmethod put(provider: str, from_env: bool = False, file_path: Optional[str] = None, secret: Optional[dict] = None, group: Optional[str] = None, headers: Optional[dict] = None)[source]

Upload locally configured secrets for a specified provider into Vault. To upload custom provider secrets, include the secret param and specify the keys and values to upload.

Parameters:

• from_env (bool) – Whether to read secrets from environment variables instead of local config files. (Default: False)

• file_path (str or None) – If provided, will read secrets directly from specified file instead of default config file.

• secret (dict or None) – Dict mapping provider secrets to value, if not loading from env or file.

• group (str or None) – If provided, will attribute secrets to the specified group.

Example

>>> rh.put(provider="lambda", secret={"api_key": *****})
>>> rh.put(provider="aws", file_path="~/.aws/credentials")

Copied

classmethod save_provider_secrets(secrets: dict, check_enabled=True)[source]

Save secrets for each provider to their respective local configs.

Example

>>> rh.Secrets.save_provider_secrets(secrets={"lambda": {"api_key": ******}})

Copied

classmethod save_secrets(secrets: Dict, overwrite: bool = False) → Dict[source]

Save secrets for providers to their respective configs.

classmethod to(system: Union[str, Cluster], providers: Optional[List[str]] = None)[source]

Copy secrets to the desired cluster for a list of builtin providers.

Parameters:

• system (str or Cluster) – Cluster to send secrets to.

• providers (List[str] or None) – Providers to send secrets for. If no providers are specified, will load all builtin providers that are already enabled.

Example

>>> rh.Secrets.to(my_cluster, providers=["aws", "lambda"])

Copied

classmethod update(provider: str, secrets: dict)[source]

Add new keys to existing secrets saved for a given provider in Vault.

Example

>>> rh.Secrets.update(provider="lambda", secrets={"api_key": new_api_key})

Copied