diff --git a/docs/web/curation/vend-secret.mdx b/docs/web/curation/vend-secret.mdx index 801f16436..cdebc0b8d 100644 --- a/docs/web/curation/vend-secret.mdx +++ b/docs/web/curation/vend-secret.mdx @@ -29,7 +29,7 @@ code already reads: import os from lancedb import EnvVarSecret, udf -db.create_secret("openai-prod", os.environ["OPENAI_API_KEY"]) +db.create_secret("embedding-api-key", os.environ["EMBEDDING_API_KEY"]) @udf class embed_remote: @@ -37,7 +37,7 @@ class embed_remote: import os from openai import OpenAI - self.client = OpenAI(api_key=os.environ["OPENAI_API_KEY"]) + self.client = OpenAI(api_key=os.environ["EMBEDDING_API_KEY"]) self.model = model def __call__(self, text: str) -> list[float]: @@ -46,13 +46,15 @@ class embed_remote: version = db.create_function_async( embed_remote, - secrets=[EnvVarSecret(secret_name="openai-prod", env_variable="OPENAI_API_KEY")], + secrets=[ + EnvVarSecret(secret_name="embedding-api-key", env_variable="EMBEDDING_API_KEY") + ], ).wait() ``` The function's own code never names the Secret -- it reads -`OPENAI_API_KEY` the same way it would outside LanceDB. The binding, in +`EMBEDDING_API_KEY` the same way it would outside LanceDB. The binding, in `secrets=[...]`, is what connects that variable to the stored credential. It is checked for shape at registration (valid variable name, not reserved, not repeated) but not resolved yet: the Secret does not have to exist until @@ -205,7 +207,7 @@ privilege. The error names the object you are missing. **The Function runs but its provider rejects the key**: a misspelled *environment variable* cannot be caught at registration, because nothing knows which variables a Function reads. Check that `env_variable` matches -what the library expects, for example `OPENAI_API_KEY`. +what the Function's code reads, such as `EMBEDDING_API_KEY` above. ## Related guides {#next} diff --git a/docs/web/governance/authorization.mdx b/docs/web/governance/authorization.mdx index 68d33370c..41d4f67f0 100644 --- a/docs/web/governance/authorization.mdx +++ b/docs/web/governance/authorization.mdx @@ -25,8 +25,8 @@ often, looks like this: ```sql SQL icon="database" -GRANT USAGE ON SECRET platform.`openai-prod` TO ROLE research -REVOKE USAGE ON SECRET platform.`openai-prod` FROM ROLE research +GRANT USAGE ON SECRET platform.`model-api-key` TO ROLE research +REVOKE USAGE ON SECRET platform.`model-api-key` FROM ROLE research ``` diff --git a/docs/web/governance/principals.mdx b/docs/web/governance/principals.mdx index 346b7a8bc..a56d2b2d8 100644 --- a/docs/web/governance/principals.mdx +++ b/docs/web/governance/principals.mdx @@ -24,9 +24,9 @@ optional keyword to disambiguate: ```sql SQL icon="database" -GRANT USAGE ON SECRET platform.`openai-prod` TO ROLE research -GRANT USAGE ON SECRET platform.`openai-prod` TO USER alice -GRANT USAGE ON SECRET platform.`openai-prod` TO GROUP `data-science` +GRANT USAGE ON SECRET platform.`model-api-key` TO ROLE research +GRANT USAGE ON SECRET platform.`model-api-key` TO USER alice +GRANT USAGE ON SECRET platform.`model-api-key` TO GROUP `data-science` ``` @@ -41,7 +41,7 @@ keyword after the first: ```sql SQL icon="database" -GRANT USAGE ON SECRET platform.`openai-prod` TO ROLE etl, rotation_service +GRANT USAGE ON SECRET platform.`model-api-key` TO ROLE etl, rotation_service ``` diff --git a/docs/web/governance/privileges.mdx b/docs/web/governance/privileges.mdx index 44f9928ba..e437b916f 100644 --- a/docs/web/governance/privileges.mdx +++ b/docs/web/governance/privileges.mdx @@ -73,11 +73,11 @@ GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE events TO ROLE etl GRANT SELECT ON VIEW dashboard TO ROLE analysts GRANT SELECT, UPDATE ON MATERIALIZED VIEW daily_rollup TO ROLE analysts GRANT CREATE SECRET, CREATE FUNCTION ON SCHEMA platform TO ROLE platform_admins -GRANT USAGE, UPDATE ON SECRET platform.`openai-prod` TO ROLE etl, rotation_service -GRANT OWNERSHIP ON SECRET platform.`openai-prod` TO ROLE platform_admins +GRANT USAGE, UPDATE ON SECRET platform.`model-api-key` TO ROLE etl, rotation_service +GRANT OWNERSHIP ON SECRET platform.`model-api-key` TO ROLE platform_admins GRANT USAGE ON FUNCTION platform.embed TO ROLE etl GRANT USAGE ON STORAGE INTEGRATION platform.hub TO ROLE research -REVOKE UPDATE ON SECRET platform.`openai-prod` FROM ROLE etl +REVOKE UPDATE ON SECRET platform.`model-api-key` FROM ROLE etl ``` @@ -123,10 +123,10 @@ own. ### Example: sharing one key {#example} - A **platform operator** owns the `platform` namespace. They create - `platform$openai-prod`, then grant the `research` group `USAGE` on that + `platform$model-api-key`, then grant the `research` group `USAGE` on that one Secret. - A **researcher** in `research` registers a Function bound to - `platform$openai-prod`. Binding any other Secret in `platform` is + `platform$model-api-key`. Binding any other Secret in `platform` is refused. - A **table owner** in `research` adds a column computed by that Function. They hold `USAGE` on the Secret through the group, but are refused until diff --git a/docs/web/management/secret.mdx b/docs/web/management/secret.mdx index b8a37fb51..66d71afd7 100644 --- a/docs/web/management/secret.mdx +++ b/docs/web/management/secret.mdx @@ -32,29 +32,29 @@ namespace. ```python Python -db.create_secret("openai-prod", value, namespace_path=["platform"]) +db.create_secret("model-api-key", value, namespace_path=["platform"]) -db.alter_secret("openai-prod", new_value, namespace_path=["platform"]) +db.alter_secret("model-api-key", new_value, namespace_path=["platform"]) for name in db.list_secrets(namespace_path=["platform"]): print(name) -info = db.describe_secret("openai-prod", namespace_path=["platform"]) +info = db.describe_secret("model-api-key", namespace_path=["platform"]) info.created_at_millis, info.updated_at_millis -db.drop_secret("openai-prod", namespace_path=["platform"]) +db.drop_secret("model-api-key", namespace_path=["platform"]) ``` ```sql SQL -CREATE SECRET platform.`openai-prod` TYPE = GENERIC_STRING SECRET_STRING = 'sk-...'; +CREATE SECRET platform.`model-api-key` TYPE = GENERIC_STRING SECRET_STRING = ''; -ALTER SECRET platform.`openai-prod` SET SECRET_STRING = 'sk-...'; +ALTER SECRET platform.`model-api-key` SET SECRET_STRING = ''; SHOW SECRETS IN platform; -DESCRIBE SECRET platform.`openai-prod`; +DESCRIBE SECRET platform.`model-api-key`; -DROP SECRET platform.`openai-prod`; +DROP SECRET platform.`model-api-key`; ``` ```rust @@ -62,19 +62,19 @@ use futures::TryStreamExt; let namespace = vec!["platform".to_string()]; -db.create_secret("openai-prod", &value, &namespace).await?; +db.create_secret("model-api-key", &value, &namespace).await?; -db.alter_secret("openai-prod", &new_value, &namespace).await?; +db.alter_secret("model-api-key", &new_value, &namespace).await?; let mut names = db.list_secrets(&namespace, Default::default()); while let Some(name) = names.try_next().await? { println!("{name}"); } -let info = db.describe_secret("openai-prod", &namespace).await?; +let info = db.describe_secret("model-api-key", &namespace).await?; println!("{} {}", info.created_at_millis, info.updated_at_millis); -db.drop_secret("openai-prod", &namespace).await?; +db.drop_secret("model-api-key", &namespace).await?; ``` diff --git a/docs/web/sql/ddl/grant.mdx b/docs/web/sql/ddl/grant.mdx index 723aa0d77..370529209 100644 --- a/docs/web/sql/ddl/grant.mdx +++ b/docs/web/sql/ddl/grant.mdx @@ -26,10 +26,10 @@ GRANT OPERATE, USAGE ON SYSTEM TO ROLE ops GRANT USAGE, CREATE SCHEMA ON DATABASE analytics TO ROLE readers GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE events TO ROLE etl GRANT CREATE SECRET, CREATE FUNCTION ON SCHEMA platform TO ROLE platform_admins -GRANT USAGE, UPDATE ON SECRET platform.`openai-prod` TO ROLE etl, rotation_service -GRANT USAGE ON SECRET platform.`openai-prod` TO USER alice, GROUP ID 'g1' +GRANT USAGE, UPDATE ON SECRET platform.`model-api-key` TO ROLE etl, rotation_service +GRANT USAGE ON SECRET platform.`model-api-key` TO USER alice, GROUP ID 'g1' GRANT USAGE ON FUNCTION platform.embed TO ROLE research -GRANT OWNERSHIP ON SECRET platform.`openai-prod` TO ROLE platform_admins +GRANT OWNERSHIP ON SECRET platform.`model-api-key` TO ROLE platform_admins REVOKE USAGE ON FUNCTION platform.embed FROM ROLE research ``` diff --git a/docs/web/sql/ddl/secret.mdx b/docs/web/sql/ddl/secret.mdx index 6c6e3c4c6..922dec247 100644 --- a/docs/web/sql/ddl/secret.mdx +++ b/docs/web/sql/ddl/secret.mdx @@ -21,8 +21,8 @@ and `-`, so quote one that contains `.` or `-`: ```sql SQL icon="database" api_key -platform.`openai-prod` -analytics.`ml$vision`.`openai-prod` +platform.`model-api-key` +analytics.`ml$vision`.`model-api-key` ``` @@ -34,8 +34,8 @@ Secret (for `ALTER` and `DROP`) is an error rather than a status. ```sql SQL icon="database" -CREATE SECRET platform.`openai-prod` TYPE = GENERIC_STRING SECRET_STRING = 'sk-...' -CREATE SECRET IF NOT EXISTS api_key TYPE = GENERIC_STRING SECRET_STRING = $$sk-...$$ +CREATE SECRET platform.`model-api-key` TYPE = GENERIC_STRING SECRET_STRING = '' +CREATE SECRET IF NOT EXISTS api_key TYPE = GENERIC_STRING SECRET_STRING = $$$$ ``` @@ -47,8 +47,8 @@ value never has to appear in the SQL text itself: ```python Python icon="python" db.execute_query( - "CREATE SECRET platform.`openai-prod` TYPE = GENERIC_STRING SECRET_STRING = $1", - parameters=["sk-..."], + "CREATE SECRET platform.`model-api-key` TYPE = GENERIC_STRING SECRET_STRING = $1", + parameters=[""], ) ``` @@ -63,8 +63,8 @@ overwrites an existing Secret; use `ALTER SECRET`. ```sql SQL icon="database" -ALTER SECRET platform.`openai-prod` SET SECRET_STRING = 'sk-...' -ALTER SECRET IF EXISTS api_key SET SECRET_STRING = $$sk-...$$ +ALTER SECRET platform.`model-api-key` SET SECRET_STRING = '' +ALTER SECRET IF EXISTS api_key SET SECRET_STRING = $$$$ ``` @@ -81,7 +81,7 @@ The status is `altered`, or `not_found` with `IF EXISTS`. ```sql SQL icon="database" -DROP SECRET platform.`openai-prod` +DROP SECRET platform.`model-api-key` DROP SECRET IF EXISTS api_key ``` @@ -104,7 +104,7 @@ SHOW SECRETS SHOW SECRETS IN platform SHOW SECRETS IN analytics.`ml$vision` SHOW SECRETS IN public -SHOW SECRETS IN platform WHERE name > 'openai-prod' LIMIT 50 +SHOW SECRETS IN platform WHERE name > 'model-api-key' LIMIT 50 ``` @@ -118,7 +118,7 @@ bounds the page size; `WHERE` must compare `name` with `>`. Requires ```sql SQL icon="database" -DESCRIBE SECRET platform.`openai-prod` +DESCRIBE SECRET platform.`model-api-key` DESC SECRET api_key ``` @@ -139,8 +139,8 @@ A missing Secret is an error. Requires `USAGE` on the Secret. ```sql SQL icon="database" GRANT CREATE SECRET ON SCHEMA platform TO ROLE platform_admins -GRANT USAGE, UPDATE ON SECRET platform.`openai-prod` TO ROLE etl, rotation_service -REVOKE UPDATE ON SECRET platform.`openai-prod` FROM ROLE etl +GRANT USAGE, UPDATE ON SECRET platform.`model-api-key` TO ROLE etl, rotation_service +REVOKE UPDATE ON SECRET platform.`model-api-key` FROM ROLE etl ``` diff --git a/python/python/lancedb/db.py b/python/python/lancedb/db.py index 3ff657a6c..e73a44aec 100644 --- a/python/python/lancedb/db.py +++ b/python/python/lancedb/db.py @@ -986,12 +986,12 @@ class DBConnection(EnforceOverrides): Examples -------- ```python - db.create_secret("openai-prod", os.environ["OPENAI_API_KEY"]) + db.create_secret("model-api-key", os.environ["MODEL_API_KEY"]) db.create_function( analyze_caption, secrets=[ EnvVarSecret( - secret_name="openai-prod", env_variable="OPENAI_API_KEY" + secret_name="model-api-key", env_variable="MODEL_API_KEY" ) ], ) diff --git a/python/python/lancedb/secrets.py b/python/python/lancedb/secrets.py index 75ac9e340..ebafadbc5 100644 --- a/python/python/lancedb/secrets.py +++ b/python/python/lancedb/secrets.py @@ -72,7 +72,7 @@ class EnvVarSecret: Pass these in the ``secrets`` sequence of [DBConnection.create_function][lancedb.db.DBConnection.create_function]. The - Function's source is unchanged by binding: it reads ``OPENAI_API_KEY`` the + Function's source is unchanged by binding: it reads ``MODEL_API_KEY`` the way it always did, and the binding is what puts a value there. This is a local value. Constructing it contacts no server, so it always @@ -101,10 +101,10 @@ class EnvVarSecret: -------- >>> from lancedb import EnvVarSecret >>> binding = EnvVarSecret( - ... secret_name="openai-prod", env_variable="OPENAI_API_KEY" + ... secret_name="model-api-key", env_variable="MODEL_API_KEY" ... ) >>> binding.secret_name, binding.env_variable - ('openai-prod', 'OPENAI_API_KEY') + ('model-api-key', 'MODEL_API_KEY') """ __slots__ = ("_secret_name", "_env_variable", "_secret_namespace_path")