Merge pull request #36 from dmaniloff/token-as-secret-and-redacted

refactor: rename pipelines_token to pipelines_api_token to get logs redacted && use SecretStr.

Author: dmaniloff

distribution/run-remote.yaml

@@ -21,7 +21,7 @@ providers:
           namespace: ${env.KUBEFLOW_NAMESPACE}
           llama_stack_url: ${env.KUBEFLOW_LLAMA_STACK_URL}
           base_image: ${env.KUBEFLOW_BASE_IMAGE}
-          pipelines_token: ${env.KUBEFLOW_PIPELINES_TOKEN:=}
+          pipelines_api_token: ${env.KUBEFLOW_PIPELINES_TOKEN:=}
   datasetio:
     - provider_id: localfs
       provider_type: inline::localfs

docs/modules/ROOT/pages/remote-provider.adoc

@@ -213,7 +213,7 @@ eval:
         namespace: ${env.KUBEFLOW_NAMESPACE}
         llama_stack_url: ${env.KUBEFLOW_LLAMA_STACK_URL}
         base_image: ${env.KUBEFLOW_BASE_IMAGE}
-        pipelines_token: ${env.KUBEFLOW_PIPELINES_TOKEN:=}
+        pipelines_api_token: ${env.KUBEFLOW_PIPELINES_TOKEN:=}
 ----
 
 To run with the sample distribution:

src/llama_stack_provider_ragas/config.py

@@ -1,5 +1,5 @@
 from llama_stack.schema_utils import json_schema_type
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, SecretStr
 
 
 class RagasConfig(BaseModel):
@@ -112,7 +112,7 @@ class KubeflowConfig(BaseModel):
         default=None,
     )
 
-    pipelines_token: str | None = Field(
+    pipelines_api_token: SecretStr | None = Field(
         description=(
             "Kubeflow Pipelines token with access to submit pipelines. "
             "If not provided via env var, the token will be read from the local kubeconfig file."

src/llama_stack_provider_ragas/remote/ragas_remote_eval.py

@@ -109,9 +109,11 @@ def kfp_client(self):
         return self._kfp_client
 
     def _get_kfp_token(self) -> str:
-        if self.config.kubeflow_config.pipelines_token:
+        if self.config.kubeflow_config.pipelines_api_token:
             logger.info("Using KUBEFLOW_PIPELINES_TOKEN from config")
-            return self.config.kubeflow_config.pipelines_token
+            return str(
+                self.config.kubeflow_config.pipelines_api_token.get_secret_value()
+            )
 
         try:
             from .kubeflow.utils import _load_kube_config