Skip to main content

Vault

Most of AstroPulse stores no credential at all: it reaches your cloud with short-lived access, and add-ons use your cluster's own identity. Vault lists the few credentials it does keep for your organization: a self-hosted cluster's cloud keys, the keys of a cluster created with static credentials, a Hugging Face token, the API keys AstroPulse manages for an access policy, and a Slack webhook. Each entry says what the credential is, what it is used for, whether it belongs to the organization or one cluster, and when it was stored, checked and rotated. The secrets themselves are never shown. From the same list an admin revokes any of them, or replaces a self-hosted cluster's key.

You do not add credentials here. Each integration stores its own when you connect it, and it appears in the list.

When you need it​

  • You want one place that shows what AstroPulse holds for your organization, for a security review or an audit.
  • A key may have leaked, or someone left, and you need to cut off what AstroPulse can do with it.
  • A check refused a credential and you want to see which one and why.
  • A self-hosted cluster's cloud key is due for rotation.

Before you start​

  • A member of the organization, to see the list.
  • To revoke or replace, an organization owner or admin. Everyone else sees Revoke and Replace disabled: "Only organization owners and admins can do this."
  • Signed in as a person. A service account's API key is refused.

In the console​

  1. Open Integrations > Vault. Under Stored credentials each entry shows its name, what it is used for, and its Scope: the organization, or the cluster it belongs to. With nothing stored yet it reads Nothing stored yet.
  2. Narrow the list with the All, Organization and Clusters chips, or search by credential, cluster or person.
  3. To revoke one, select Revoke on its row. Revoke credential asks "Revoke <credential>?" and says what stops, for example "What it is used for stops: Gated model downloads on every cluster." Type revoke and select Revoke.
  4. To replace a self-hosted cluster's key, select Replace on its row. Replace credential shows what to do and the astroctl command to run, with the cluster's own values filled in. Run it in a terminal, then select Check again to see the new check.
Open zoom view

Integrations > Vault: How it works, and Stored credentials with a Hugging Face token at organization scope and the API keys of two access policies, each with Revoke

Integrations > Vault: How it works, and Stored credentials with a Hugging Face token at organization scope and the API keys of two access policies, each with RevokeIntegrations > Vault: How it works, and Stored credentials with a Hugging Face token at organization scope and the API keys of two access policies, each with Revoke

You should see​

The Stored credentials table, with Credential, Scope, Stored (when, and by whom), Last checked and Rotated. When the last check refused a credential, the reason shows under Last checked in red.

After a revoke, a notice at the top reads Revoked: <credential> and says what no longer works. Select Dismiss to close it. The credential leaves the list.

How credentials are kept safe​

  • AstroPulse checks each credential before it keeps it, and stores it encrypted.
  • A stored value is never returned, to the console, astroctl or the API. The list shows names, scope and dates only.
  • Every member can see the list. Who stored a credential, and its ID, are shown to owners and admins only.
  • Only owners and admins can revoke or replace, and every read and change is recorded in the audit log.
  • A new self-hosted key is entered in your terminal, never in the browser, and AstroPulse checks it against the cluster's cloud account before it replaces the stored one.

What revoking does​

Revoking deletes every stored version of the credential. The notice says what stops; for example:

  • Hugging Face token: within about ten minutes the token is withdrawn from your clusters. Running models keep what they downloaded.
  • A self-hosted cluster's keys: AstroPulse can no longer create, change, repair or delete the cluster. The cluster itself keeps running. Connect again to restore its credentials.
  • API keys of an access policy: every key of that policy stops working within a minute.

For some credentials AstroPulse also revokes them at their provider. When that fails, the notice says so: AstroPulse's copy is gone, but the credential may still work at the provider, so revoke it there too.

Replace a self-hosted cluster's key​

Only a self-hosted cluster's AWS or Google Cloud key has Replace. Make the new key in your cloud first: a new access key for the IAM user, saved as an AWS CLI profile, or a new JSON key for the service account. Run the command Replace credential shows. AstroPulse checks the new key and stores it only when every check passes. The old key stays valid in your cloud account until you delete it there.

Other ways in​

With astroctl​

Terminal
# every credential, with its scope, state and last check
astroctl integrations vault list
# -o wide adds what each is used for and its lease ID
astroctl integrations vault list -o wide
# one cluster's, or one kind
astroctl integrations vault list --cluster prod
astroctl integrations vault list --kind huggingface
# one credential in full
astroctl integrations vault get <lease-id>
# revoke; asks you to confirm, --yes skips the question
astroctl integrations vault revoke <lease-id>
# replace a self-hosted cluster's AWS key from an AWS CLI profile
astroctl integrations vault replace <lease-id> --profile prod-rotated

<lease-id> is the lease ID from list -o wide. replace reads the new key from a file, an AWS CLI profile or standard input, never from the command line. Every flag: astroctl integrations vault.

If it's refused​

"Only organization owners and admins can do this."
Cause
Your role may not manage the organization's credentials. The API answers "Only an organization admin can manage the organization's credentials." in the same case.
Fix
Ask an organization owner or admin to revoke or replace it.
"This operation requires a user identity"
Cause
The call was made with a service account's API key.
Fix
Sign in as an owner or admin, or use your own API key.
Unreadable: "Revoke it, then connect it again."
Cause
AstroPulse holds the credential but cannot read it.
Fix
Select Revoke, then connect the integration again so it stores a new one.
"Cluster <cluster> has an operation in progress, so AstroPulse can't revoke its stored key now: the operation is using it. Try again once it finishes."
Cause
A self-hosted cluster's key is in use by a create, change or delete that is running.
Fix
Wait for the operation to finish, then revoke again.
"AstroPulse credential storage cannot be reached right now; try again in a minute"
Cause
The list or the change could not reach where credentials are stored.
Fix
Try again in a minute.

Next​