Arvados

h1. Vault

Going through the docs, a strawman proposal on how to use Vault from an Arvados container:

* Credentials are entered into Vault

* Client (arvados-cwl-runner?) generates a Vault token with restricted policy (can only read credentials)

* Container request is expanded to include Vault token

* Vault token cannot be read back from container request via API

* Cannot have container reuse with Vault tokens

* On the compute node, read the container record

* The container record only includes the vault token when queried by the container run token.

* The container can now read the secret at the path provided in the input

* When the container request is finalized, the Vault token is revoked.

Notes:

* Credentials may be passed in via environment, config file or command line like any other input, so it would be nice to generalize this as a CWL feature where some inputs are simply marked "sensitive" and automatically handled by Vault.  However, while arvados-cwl-runner is responsible for constructing the container request it doesn't run on the compute node, only crunch-run, which is "dumb", so its not clear how we go about allowing for arbitrary substitution into the environment, command line, or config file on the compute node.

* Response wrapping is another mechanism provided by Vault for delegating access.  A wrapped response can be passed through and accessed exactly once (would imply max_container_count: 1).