Skip to content

Commit 8205c52

Browse files
V2arKV2arK
committed
add script for interacting with user vault
1 parent debc10f commit 8205c52

2 files changed

Lines changed: 280 additions & 0 deletions

File tree

‎scripts/user_vault/README.md‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
# User Vault Scripts
2+
3+
Scripts for managing user vault (secrets) in CentML Platform.
4+
5+
## Overview
6+
7+
The CentML User Vault is a secure storage system for sensitive information that can be used across your deployments. This includes environment variables, API tokens, SSH keys, and certificates. These scripts allow you to view and manage your vault items from the command line.
8+
9+
## Prerequisites
10+
11+
### 1. Install the centml package
12+
13+
From the repository root directory:
14+
15+
```bash
16+
pip install -e ./
17+
```
18+
19+
Or install directly from GitHub:
20+
21+
```bash
22+
pip install git+https://github.com/CentML/centml-python-client.git@main
23+
```
24+
25+
### 2. Authenticate with CentML
26+
27+
Login to your CentML account:
28+
29+
```bash
30+
centml login
31+
```
32+
33+
This will open a browser window for authentication. Once completed, your credentials will be stored locally.
34+
35+
## Available Scripts
36+
37+
### get_vault_items.py
38+
39+
Retrieves and displays all items stored in your CentML vault.
40+
41+
#### Supported Vault Types
42+
43+
| Type | Description | Example Use Case |
44+
|------|-------------|------------------|
45+
| `env_vars` | Environment variables | Database URLs, API endpoints |
46+
| `ssh_keys` | SSH keys | Git repository access |
47+
| `bearer_tokens` | Bearer tokens | Service authentication |
48+
| `access_tokens` | Access tokens | HuggingFace tokens, Weights & Biases API keys |
49+
| `certificates` | Certificates | TLS/SSL certificates |
50+
51+
#### Usage
52+
53+
Run the script from the `scripts/user_vault` directory:
54+
55+
```bash
56+
cd scripts/user_vault
57+
python get_vault_items.py [OPTIONS]
58+
```
59+
60+
#### Command Line Options
61+
62+
| Option | Description | Default |
63+
|--------|-------------|---------|
64+
| `--type TYPE` | Filter results by vault type (see supported types above) | Show all types |
65+
| `--search QUERY` | Filter items by key name (case-sensitive substring match) | No filter |
66+
| `--show-values` | Display the actual secret values | Keys only |
67+
| `--help` | Show help message and exit | - |
68+
69+
#### Examples
70+
71+
**List all vault items (keys only):**
72+
73+
```bash
74+
python get_vault_items.py
75+
```
76+
77+
**List only environment variables:**
78+
79+
```bash
80+
python get_vault_items.py --type env_vars
81+
```
82+
83+
**List only access tokens (e.g., HuggingFace tokens):**
84+
85+
```bash
86+
python get_vault_items.py --type access_tokens
87+
```
88+
89+
**Search for items containing "HF" in the key name:**
90+
91+
```bash
92+
python get_vault_items.py --search HF
93+
```
94+
95+
**Show all items with their values:**
96+
97+
```bash
98+
python get_vault_items.py --show-values
99+
```
100+
101+
**Combine multiple options:**
102+
103+
```bash
104+
python get_vault_items.py --type env_vars --show-values --search DATABASE
105+
```
106+
107+
#### Example Output
108+
109+
Without `--show-values`:
110+
111+
```
112+
Found 5 vault item(s)
113+
114+
==================================================
115+
Type: access_tokens (2 item(s))
116+
==================================================
117+
HF_TOKEN
118+
WANDB_API_KEY
119+
120+
==================================================
121+
Type: env_vars (3 item(s))
122+
==================================================
123+
API_KEY
124+
DATABASE_URL
125+
MY_SECRET
126+
```
127+
128+
With `--show-values`:
129+
130+
```
131+
Found 5 vault item(s)
132+
133+
==================================================
134+
Type: access_tokens (2 item(s))
135+
==================================================
136+
HF_TOKEN: hf_xxxxxxxxxxxxxxxxxxxx
137+
WANDB_API_KEY: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
138+
139+
==================================================
140+
Type: env_vars (3 item(s))
141+
==================================================
142+
API_KEY: sk-xxxxxxxxxxxxxxxx
143+
DATABASE_URL: postgresql://user:pass@host:5432/db
144+
MY_SECRET: my-secret-value
145+
```
146+
147+
## Troubleshooting
148+
149+
### Authentication Error
150+
151+
If you see an authentication error, try logging in again:
152+
153+
```bash
154+
centml login
155+
```
156+
157+
### Module Not Found
158+
159+
If you see `ModuleNotFoundError`, ensure you have installed the centml package:
160+
161+
```bash
162+
pip install -e ./
163+
```
164+
165+
### No Items Found
166+
167+
If the script returns "No vault items found", verify that:
168+
1. You are logged into the correct CentML account
169+
2. You have created vault items in the CentML web UI or via API

‎scripts/user_vault/get_vault_items.py‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
#!/usr/bin/env python3
2+
"""
3+
Script to retrieve all items from a user's vault (secrets).
4+
5+
This script allows you to view all secrets stored in your CentML vault,
6+
including environment variables, SSH keys, bearer tokens, access tokens,
7+
and certificates.
8+
"""
9+
10+
from typing import Optional
11+
12+
import click
13+
14+
from centml.sdk.api import get_centml_client
15+
from platform_api_python_client import UserVaultType
16+
17+
18+
def get_vault_items(
19+
vault_type: Optional[UserVaultType] = None,
20+
search_query: Optional[str] = None,
21+
):
22+
"""Retrieve items from user's vault."""
23+
with get_centml_client() as client:
24+
response = client._api.get_all_user_vault_items_endpoint_user_vault_get(
25+
type=vault_type,
26+
search_query=search_query,
27+
)
28+
return response.results
29+
30+
31+
def display_vault_items(items, show_values: bool = False):
32+
"""Display vault items grouped by type."""
33+
if not items:
34+
click.echo("No vault items found.")
35+
return
36+
37+
# Group items by type
38+
grouped = {}
39+
for item in items:
40+
vault_type = item.type
41+
if vault_type not in grouped:
42+
grouped[vault_type] = []
43+
grouped[vault_type].append(item)
44+
45+
click.echo(f"\nFound {len(items)} vault item(s)\n")
46+
47+
for vault_type, type_items in sorted(grouped.items(), key=lambda x: x[0]):
48+
click.echo(f"{'='*50}")
49+
click.echo(f"Type: {vault_type} ({len(type_items)} item(s))")
50+
click.echo(f"{'='*50}")
51+
52+
for item in sorted(type_items, key=lambda x: x.key):
53+
if show_values and item.value is not None:
54+
click.echo(f" {item.key}: {item.value}")
55+
else:
56+
click.echo(f" {item.key}")
57+
58+
click.echo("")
59+
60+
61+
@click.command()
62+
@click.option(
63+
"--type",
64+
"vault_type",
65+
type=click.Choice([t.value for t in UserVaultType], case_sensitive=False),
66+
help="Filter by vault type (env_vars, ssh_keys, bearer_tokens, access_tokens, certificates)",
67+
)
68+
@click.option(
69+
"--search",
70+
"search_query",
71+
type=str,
72+
help="Search query to filter items by key",
73+
)
74+
@click.option(
75+
"--show-values",
76+
is_flag=True,
77+
default=False,
78+
help="Show vault item values",
79+
)
80+
def main(vault_type: Optional[str], search_query: Optional[str], show_values: bool):
81+
"""Retrieve all items from user's vault (secrets).
82+
83+
This script uses the centml CLI authentication,
84+
so make sure you are logged in to centml CLI before running this script.
85+
86+
\b
87+
Examples:
88+
# Get all vault items
89+
python get_vault_items.py
90+
91+
# Get only environment variables
92+
python get_vault_items.py --type env_vars
93+
94+
# Search for items containing 'HF'
95+
python get_vault_items.py --search HF
96+
97+
# Show values
98+
python get_vault_items.py --show-values
99+
"""
100+
type_enum = UserVaultType(vault_type) if vault_type else None
101+
102+
items = get_vault_items(
103+
vault_type=type_enum,
104+
search_query=search_query,
105+
)
106+
107+
display_vault_items(items, show_values=show_values)
108+
109+
110+
if __name__ == "__main__":
111+
main()

0 commit comments

Comments
 (0)