Skip to content

External Connection

Before you start

Goal

  • Connect the Altair SLC Hub to an existing object store.

Prerequisites

  • Have the credentials for the running object store.
  • Altair SLC Hub configuration privileges for the host.

Internal Object Store

Configuring an Object Store Connection

Altair SLC Hub requires a connection to an object store to store large object data.

The connection to the object is configured using the object_store configuration section. A list of the configuration settings and comments on their use is found in the Altair SLC Hub configuration file [etc directory]/config.d/object_store.yaml.

To configure an object store connection, create a new file in the same directory with a lexicographically greater name. For example, create an object_store_custom.yaml file, then modify the settings in that file appropriately.

How Altair SLC Hub authenticates to object storage

Altair SLC Hub authenticates to object storage using the credentials required by the selected storage backend.

For most backends, this is done using a credential pair provided by the storage service, such as:

  • Amazon S3 or S3-compatible storage: access key ID and secret access key
  • Azure Blob Storage: account name and account key

In practice, this works much like a service username and password: one value identifies the account, and the other provides the secret used for authentication.

Altair SLC Hub also supports storing these credentials in Vault, so that sensitive values can be managed as secrets rather than stored directly in configuration.

For Amazon S3, Altair SLC Hub can also use AWS IAM-based authentication. In that case, explicit access keys may not be required, because authentication is performed using the AWS identity available in the runtime environment.

Configuring Vault credentials for object store

To configure Altair SLC Hub to use authentication credentials fetched from Vault, it is necessary to set the object_store.vaultSecret to the path of the secret from which the credentials should be fetched. It is expected that the secret has values called access_key_id, secret_access_key and session_token.

Note that only the static KV secrets engine is supported for S3 authentication.

It may be necessary to set the value of the object_store.vaultSecretExpiry parameter to limit how long the credentials fetched from Vault are to be considered valid. If the credentials necessary to connect to object store change, ensure that both the old credentials and the new credentials are valid for period of time to enable Altair SLC Hub to connect with the old object store credentials until it considers that they have expired and re-fetches the credentials from Vault. The default value of the object_store.vaultSecretExpiry configuration property is one hour, meaning that if the authentication credentials are changed it is necessary to ensure that the old credentials and the new credentials are both valid for one hour to ensure that Altair SLC Hub can continue to make connections during this period.

Configuring an S3 Object Store Connection

Make sure the type is set to s3:

object_store:
  type: s3
  endpoint: <URL endpoint>
  accessKeyId: <access key>
  secretAccessKey: <secret key>
  bucketName: <bucket name>

The Altair SLC Hub stores all objects in a single bucket in the object store, and it is assumed that a dedicated bucket is intended for use by Altair SLC Hub. For security, we recommended a dedicated user is created, ensuring that only the dedicated user has write permission to the relevant bucket.

Configuring an Azure Blob Storage Connection

Altair SLC Hub can also connect to Azure Blob Storage. Make sure the type is set to azure:

object_store:
  type: azure
  endpoint: <URL endpoint>
  containerName: <container name>
  insecure: <true or false>
  azureAccountName: <azure account name>
  azureAccountKey: <azure account key>

Configuring a Google Cloud Storage Connection

Altair SLC Hub can also connect to Google Cloud Storage. This is another S3 type of storage, so ensure the type is set to s3:

object_store:
  type: s3
  accessKeyId: <access key>
  bucketName: <bucket name>
  endpoint: storage.googleapis.com
  secretAccessKey: <secret key>

Other Store Providers

Instructions on installing and configuring MinIO locally for use by Altair SLC Hub are available in the Altair Community. Alternatively, use the Altair SLC Hub internal object store.

Verification

Verify object store

  • run the hubctl verify objectstore command

Before continuing, it is necessary to verify that the connection information for the object store is correct. To do this, use the following hubctl command:

hubctl verify objectstore