nemo_gym.config.secret_utils

Module Contents

Functions

Name	Description
`hide_secrets_in_container`	Return the credential-safe config projection shared by saved artifacts and exporters.
`hide_secrets_in_overrides`	Mask `+key=value` / `++key=value` tokens whose key looks secret-shaped.
`looks_like_secret_key`	-
`mask_url_passwords`	Mask the password in the user info of every URL inside `text`, keeping the user name and the rest of the URL.
`recursively_hide_secrets`	Mask every secret-shaped leaf in place with ’****’ so a config can be printed or exported.

Data

MASKED_VALUE

_CAPTURE_PUBLIC_FIELDS

_SECRET_KEY_SUBSTRINGS

_URL_PASSWORD

API

nemo_gym.config.secret_utils.hide_secrets_in_container(
    data: typing.Any
) -> typing.Any

Return the credential-safe config projection shared by saved artifacts and exporters.

Preserve unresolved interpolations without evaluating them. Secret ancestry masks every value, including arbitrary names in a secrets mapping. The root token_id_capture mapping is a settings namespace, not a credential; its own secret-shaped children still undergo masking. Custom sink/resolver kwargs can contain credentials under arbitrary names, so their values stay masked.

nemo_gym.config.secret_utils.hide_secrets_in_overrides(
    tokens: typing.List[str]
) -> typing.List[str]

Mask +key=value / ++key=value tokens whose key looks secret-shaped.

nemo_gym.config.secret_utils.looks_like_secret_key(
    key: object
) -> bool

nemo_gym.config.secret_utils.mask_url_passwords(
    text: str
) -> str

Mask the password in the user info of every URL inside text, keeping the user name and the rest of the URL.

Only a precaution for a credential pasted into a URL: it is the user’s job to keep secrets out of the config in the first place (behind ${oc.env:NAME} or env.yaml). A password that is an interpolation is a reference rather than a secret, so it stays as it is.

nemo_gym.config.secret_utils.recursively_hide_secrets(
    dict_config: omegaconf.DictConfig
) -> None

Mask every secret-shaped leaf in place with ’****’ so a config can be printed or exported.

A leaf is secret-shaped by its own name, or by sitting anywhere below a secret-shaped key: every value of a secrets: mapping is a secret whatever its environment variable is called.

Used by the config parser and the exporters.

nemo_gym.config.secret_utils.MASKED_VALUE = '****'

nemo_gym.config.secret_utils._CAPTURE_PUBLIC_FIELDS = frozenset({'enabled', 'all_agents', 'dir', 'sink', 'lineage_store', 'rebuild_res...

nemo_gym.config.secret_utils._SECRET_KEY_SUBSTRINGS = ('token', 'key', 'header', 'password', 'passwd', 'secret', 'credential', 'bearer...

nemo_gym.config.secret_utils._URL_PASSWORD = re.compile('(?P<head>[A-Za-z][A-Za-z0-9+.\\-]*://(?:\\$\\{[^}]*\\}|[^\\s/?#:@$])...