Be able to mount secrets from Vault

[aronchick]

We need a way for a Bac job to be able to mount in secrets from vault. There could be a few approaches here:

• Having secrets/tokens distributed in Bacalhau (a la k8s secrets)
• Having credentials on the node to pull in from vault
• Having external web call available to get bearer token for vault
• Other?

[aronchick]

Some additional user experience look at this:

So, here's an example job:

Job:
  APIVersion: V1beta2
  Spec:
    Deal:
      Concurrency: 1
      TargetingMode: true
    EngineSpec:
      Params:
        EnvironmentVariables:
          - INPUTFILE=/var/log/logs_to_process/aperitivo_logs.log.1
          - QUERY=SELECT * FROM log_data WHERE message LIKE '%[SECURITY]%' ORDER BY '@timestamp'
        Image: [docker.io/bacalhauproject/motherduck-log-processor:1.1.6](http://docker.io/bacalhauproject/motherduck-log-processor:1.1.6)
        WorkingDirectory: ""
      Type: docker
    Resources:
      GPU: ""
      Memory: 4gb
    Network:
      Type: Full
    Inputs:
      - Name: file:///var/log/logs_to_process
        SourcePath: /var/log/logs_to_process
        StorageSource: LocalDirectory
        path: /var/log/logs_to_process
      - Name: file:///db/
        SourcePath: /db
        StorageSource: LocalDirectory
        path: /db

Now imagine in there there's a field "SecretManager":

    Secrets:
      - Manager: dmno-vault
        Items:
          SECRET_ONE
          SECRET_TWO

This comes from an object created elsewhere

SecretsManager:
Name: dmno-vault 
      URL: https://dmno.io
      TokenName: dmno-reader-token

And we further had a separate command:

bacalhau create service-account secret-reader
bacalhau set secret-token --vault-name dmno-vault --name "dmno-reader-token" --value "m7PZBJKJuYR3kGGrDvIqJp5aDjvtVABGEDMtlSzkdZ7fTXv6dAsFlWvjzTdMzP0G"

With this construction, when the bacalhau job runs, it reads from your vault inline, and mounts these as environment variables in the environment in which the process runs.

cc @wdbaruni for some additional thinking.