Skip to content

v0.4.4 — Persistent creds store at $workdir/.creds

Choose a tag to compare

View all tags
@myurasov myurasov released this 10 May 03:10
· 13 commits to main since this release
v0.4.4
1aee8e7

Adds a credential-store layer at $workdir/.creds. Read priority (highest first):

  1. $workdir/.creds — sourced by every bash payload that needs creds.
  2. SSH env / process env — --ngc-key / --nvidia-key / shell exports.
  3. None — caller errors.

Deliberately backwards from the usual CLI > env > config: .creds is the persistent source of truth that you set up once per target. CLI / env are useful for the FIRST install (they're what gets captured into .creds); after that the file is authoritative.

How it works

# First install captures keys from env / flags into $workdir/.creds:
$ export NGC_CLI_API_KEY=nvapi-... NVIDIA_API_KEY=nvapi-...
$ ./spectator install --target myspark1-local
...
==== wrote /home/misha/.spectator/.creds (creds persisted; future calls source it) ====

# Subsequent calls don't need keys in env — sourced from .creds:
$ unset NGC_CLI_API_KEY NVIDIA_API_KEY
$ ./spectator up --target myspark1-local   # works, sources from .creds

# Rotate keys: edit the file directly.
$ ssh myspark1-local 'vi ~/.spectator/.creds'

File format

Shell-source-able, one export VAR=VALUE per line, value quoted via printf %q. chmod 600 so other users on the host can't read it. Excluded from rsync (the file never travels off the host it was written on).

Spectator-managed vars (the "vars" tuple)

  • NGC_CLI_API_KEY — always needed (docker pull from nvcr.io).
  • NVIDIA_API_KEY — needed for remote LLM auth (default endpoint is build.nvidia.com).
  • LLM_ENDPOINT_URL — only if self-hosting the LLM.

Future contributions can add to _creds.CREDS_VARS and the round-trip is automatic.

Tests

65/65 (was 60, +5): source-block shape pin, save-block creates file with 0600 perms + skips unset vars + is idempotent, source overrides env in a real bash subprocess, install renders both blocks, up renders the source block.

Migration

None. Existing installs upgrade in place — running ./spectator install --target HOST once after upgrading creates the .creds file from current env. After that, subsequent runs don't need the env vars set.

Assets 2
Loading