veadk-python 0.2.25__tar.gz → 0.2.27__tar.gz

{veadk_python-0.2.25/veadk_python.egg-info → veadk_python-0.2.27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: veadk-python
-Version: 0.2.25
+Version: 0.2.27
 Summary: Volcengine agent development kit, integrations with Volcengine cloud services.
 Author-email: Yaozheng Fang <fangyozheng@gmail.com>, Guodong Li <cu.eric.lee@gmail.com>, Zhi Han <sliverydayday@gmail.com>, Meng Wang <mengwangwm@gmail.com>
 License:                                  Apache License

{veadk_python-0.2.25 → veadk_python-0.2.27}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "veadk-python"
-version = "0.2.25"
+version = "0.2.27"
 description = "Volcengine agent development kit, integrations with Volcengine cloud services."
 readme = "README.md"
 requires-python = ">=3.10"

{veadk_python-0.2.25 → veadk_python-0.2.27}/veadk/auth/veauth/ark_veauth.py

@@ -36,7 +36,7 @@ def get_ark_token(region: str = "cn-beijing") -> str:
         session_token = cred.session_token
 
     res = ve_request(
-        request_body={"ProjectName": "default", "Filter": {}},
+        request_body={"ProjectName": "default", "Filter": {"AllowAll": True}},
         header={"X-Security-Token": session_token},
         action="ListApiKeys",
         ak=access_key,
@@ -48,6 +48,10 @@ def get_ark_token(region: str = "cn-beijing") -> str:
     )
     try:
         first_api_key_id = res["Result"]["Items"][0]["Id"]
+        logger.warning("By default, VeADK fetches the first API Key in the list.")
+        logger.info(
+            f"Try to fetch ARK API Key with id={first_api_key_id}, name={res['Result']['Items'][0]['Name']}"
+        )
     except KeyError:
         raise ValueError(f"Failed to get ARK api key list: {res}")
 
@@ -65,7 +69,7 @@ def get_ark_token(region: str = "cn-beijing") -> str:
     )
     try:
         api_key = res["Result"]["ApiKey"]
-        logger.info("Successfully fetching ARK API Key.")
+        logger.info(f"Successfully fetched ARK API Key (starts with {api_key[:8]}).")
         return api_key
     except KeyError:
         raise ValueError(f"Failed to get ARK api key: {res}")

{veadk_python-0.2.25 → veadk_python-0.2.27}/veadk/cli/cli_deploy.py

@@ -67,6 +67,7 @@ TEMP_PATH = "/tmp"
     help="Expected Volcengine Identity client name",
 )
 @click.option("--path", default=".", help="Local project path")
+@click.option("--iam-role", default=None, help="iam role for the vefaas function")
 def deploy(
     volcengine_access_key: str,
     volcengine_secret_key: str,
@@ -80,6 +81,7 @@ def deploy(
     user_pool_name: str,
     client_name: str,
     path: str,
+    iam_role: str,
 ) -> None:
     """Deploy a user project to Volcengine FaaS application.
 
@@ -131,6 +133,8 @@ def deploy(
     from veadk.config import getenv
     from veadk.utils.logger import get_logger
     from veadk.utils.misc import formatted_timestamp, load_module_from_file
+    import os
+    from veadk.config import veadk_environments
 
     logger = get_logger(__name__)
 
@@ -138,6 +142,11 @@ def deploy(
         volcengine_access_key = getenv("VOLCENGINE_ACCESS_KEY")
     if not volcengine_secret_key:
         volcengine_secret_key = getenv("VOLCENGINE_SECRET_KEY")
+    if not iam_role:
+        iam_role = getenv("IAM_ROLE", None, allow_false_values=True)
+    else:
+        os.environ["IAM_ROLE"] = iam_role
+        veadk_environments["IAM_ROLE"] = iam_role
 
     user_proj_abs_path = Path(path).resolve()
     template_dir_path = Path(vefaas.__file__).parent / "template"

{veadk_python-0.2.25 → veadk_python-0.2.27}/veadk/cli/cli_init.py

@@ -63,16 +63,28 @@ def _render_prompts() -> dict[str, Any]:
     )
     use_adk_web = deploy_mode == "2"
 
-    auth_method_options = {
-        "1": "None",
-        "2": "API key",
-        "3": "OAuth2",
-    }
-    auth_methods = {
-        "1": "none",
-        "2": "api-key",
-        "3": "oauth2",
-    }
+    auth_method_options = {}
+    auth_methods = {}
+    if use_adk_web:
+        auth_method_options = {
+            "1": "None",
+            "2": "OAuth2",
+        }
+        auth_methods = {
+            "1": "none",
+            "2": "oauth2",
+        }
+    else:
+        auth_method_options = {
+            "1": "None",
+            "2": "API key",
+            "3": "OAuth2",
+        }
+        auth_methods = {
+            "1": "none",
+            "2": "api-key",
+            "3": "oauth2",
+        }
 
     click.echo("Choose an authentication method:")
     for key, value in auth_method_options.items():

{veadk_python-0.2.25 → veadk_python-0.2.27}/veadk/integrations/ve_faas/ve_faas.py

@@ -32,7 +32,7 @@ from veadk.integrations.ve_faas.ve_faas_utils import (
     zip_and_encode_folder,
 )
 from veadk.utils.logger import get_logger
-from veadk.utils.misc import formatted_timestamp
+from veadk.utils.misc import formatted_timestamp, getenv
 from veadk.utils.volcengine_sign import ve_request
 
 logger = get_logger(__name__)
@@ -114,10 +114,11 @@ class VeFaaS:
                 name=function_name,
                 description="Created by VeADK (Volcengine Agent Development Kit)",
                 tags=[TagForCreateFunctionInput(key="provider", value="veadk")],
-                runtime="native-python3.10/v1",
+                runtime="native-python3.12/v1",
                 request_timeout=1800,
                 envs=envs,
                 memory_mb=2048,
+                role=getenv("IAM_ROLE", None, allow_false_values=True),
             )
         )
 

{veadk_python-0.2.25 → veadk_python-0.2.27}/veadk/integrations/ve_identity/identity_client.py

@@ -56,67 +56,56 @@ def refresh_credentials(func):
     """
     import asyncio
 
+    def _try_get_vefaas_credentials():
+        """Attempt to retrieve credentials from VeFaaS IAM."""
+        try:
+            ve_iam_cred = get_credential_from_vefaas_iam()
+            return (
+                ve_iam_cred.access_key_id,
+                ve_iam_cred.secret_access_key,
+                ve_iam_cred.session_token,
+            )
+        except FileNotFoundError:
+            pass  # VeFaaS IAM file not found, ignore
+        except Exception as e:
+            logger.warning(f"Failed to retrieve credentials from VeFaaS IAM: {e}")
+        return None
+
     @wraps(func)
     def _refresh_creds(self: IdentityClient):
         """Helper to refresh credentials."""
-        # Try to get credentials from environment variables first
+        # Step 1: Get initial credentials from constructor or environment variables
         ak = self._initial_access_key or os.getenv("VOLCENGINE_ACCESS_KEY", "")
         sk = self._initial_secret_key or os.getenv("VOLCENGINE_SECRET_KEY", "")
         session_token = self._initial_session_token or os.getenv(
             "VOLCENGINE_SESSION_TOKEN", ""
         )
 
-        # Helper function to attempt VeFaaS IAM credential retrieval
-        def try_get_vefaas_credentials():
-            """Attempt to retrieve credentials from VeFaaS IAM."""
-            try:
-                logger.info("Attempting to fetch credentials from VeFaaS IAM...")
-                ve_iam_cred = get_credential_from_vefaas_iam()
-                return (
-                    ve_iam_cred.access_key_id,
-                    ve_iam_cred.secret_access_key,
-                    ve_iam_cred.session_token,
-                )
-            except FileNotFoundError as e:
-                logger.warning(f"VeFaaS IAM credentials not available: {e}")
-            except Exception as e:
-                logger.warning(f"Failed to retrieve credentials from VeFaaS IAM: {e}")
-            return None
+        # Step 2: Clear expired session_token
+        if self._is_sts_credential_expired():
+            logger.info("STS credentials expired, clearing...")
+            session_token = ""
 
-        # If no AK/SK, try to get from VeFaaS IAM
-        if not (ak and sk):
-            logger.info(
-                "Credentials not found in environment, attempting to fetch from VeFaaS IAM..."
-            )
-            credentials = try_get_vefaas_credentials()
-            if credentials:
+        # Step 3: Try VeFaaS IAM if no credentials or no session_token
+        # VeFaaS IAM provides complete credentials (ak, sk, session_token)
+        if not (ak and sk) or (ak and sk and not session_token):
+            if credentials := _try_get_vefaas_credentials():
                 ak, sk, session_token = credentials
 
-        # If we have AK/SK but no session token, try to get complete credentials
+        # Step 4: If still no session_token, try AssumeRole
         if ak and sk and not session_token:
-            # First attempt: try VeFaaS IAM
-            credentials = try_get_vefaas_credentials()
-            if credentials:
-                ak, sk, session_token = credentials
-
-            # Second attempt: if still no session token, try AssumeRole
-            if not session_token:
-                role_trn = self._get_iam_role_trn_from_vefaas_iam() or os.getenv(
-                    "RUNTIME_IAM_ROLE_TRN", ""
-                )
+            if role_trn := self._get_iam_role_trn_from_vefaas_iam() or os.getenv(
+                "RUNTIME_IAM_ROLE_TRN", ""
+            ):
+                try:
+                    sts_cred = self._assume_role(ak, sk, role_trn)
+                    ak = sts_cred.access_key_id
+                    sk = sts_cred.secret_access_key
+                    session_token = sts_cred.session_token
+                except Exception as e:
+                    logger.warning(f"Failed to assume role: {e}")
 
-                if role_trn:
-                    try:
-                        logger.info(f"Attempting AssumeRole with role: {role_trn}")
-                        sts_credentials = self._assume_role(ak, sk, role_trn)
-                        ak = sts_credentials.access_key_id
-                        sk = sts_credentials.secret_access_key
-                        session_token = sts_credentials.session_token
-                        logger.info("Successfully obtained credentials via AssumeRole")
-                    except Exception as e:
-                        logger.warning(f"Failed to assume role: {e}")
-
-        # Update configuration with the credentials
+        # Step 5: Update configuration with the credentials
         self._api_client.api_client.configuration.ak = ak
         self._api_client.api_client.configuration.sk = sk
         self._api_client.api_client.configuration.session_token = session_token
@@ -192,16 +181,9 @@ class IdentityClient:
         self._sts_credential_expires_at: Optional[int] = None
 
     def _get_iam_role_trn_from_vefaas_iam(self) -> Optional[str]:
-        logger.info(
-            f"Try to get IAM Role TRN from VeFaaS IAM file (path={VEFAAS_IAM_CRIDENTIAL_PATH})."
-        )
-
         path = Path(VEFAAS_IAM_CRIDENTIAL_PATH)
 
         if not path.exists():
-            logger.error(
-                f"Get IAM Role TRN from IAM file failed, and VeFaaS IAM file (path={VEFAAS_IAM_CRIDENTIAL_PATH}) not exists. Please check your configuration."
-            )
             return None
 
         with open(VEFAAS_IAM_CRIDENTIAL_PATH, "r") as f:
@@ -233,6 +215,9 @@ class IdentityClient:
     ) -> AssumeRoleCredential:
         """Execute AssumeRole to get STS temporary credentials.
 
+        This method performs the AssumeRole operation and caches the result.
+        Cache validation is handled by the caller (refresh_credentials decorator).
+
         Args:
             access_key: VolcEngine access key
             secret_key: VolcEngine secret key
@@ -244,16 +229,9 @@ class IdentityClient:
         Raises:
             Exception: If AssumeRole fails
         """
-        # Check if the cached credentials are still valid
-        if (
-            self._cached_sts_credential is not None
-            and not self._is_sts_credential_expired()
-        ):
-            logger.info("Using cached STS credentials")
-            return self._cached_sts_credential
-
         logger.info(
-            "Cached STS credentials expired or not found, requesting new credentials..."
+            f"Requesting new STS credentials for role: {role_trn}, "
+            f"session: {settings.veidentity.role_session_name}"
         )
 
         # Create STS client configuration
@@ -272,11 +250,7 @@ class IdentityClient:
             role_session_name=settings.veidentity.role_session_name,
         )
 
-        logger.info(
-            f"Executing AssumeRole for role: {role_trn}, "
-            f"session: {settings.veidentity.role_session_name}"
-        )
-
+        # Execute AssumeRole
         response: volcenginesdksts.AssumeRoleResponse = sts_client.assume_role(
             assume_role_request
         )
@@ -298,18 +272,19 @@ class IdentityClient:
             expires_at_timestamp = calendar.timegm(dt.timetuple())
         except Exception as e:
             logger.warning(f"Failed to parse STS credential expiration time: {e}")
-            # Expires in 1 hour by default
+            # Default to 1 hour expiration
             import time
 
             expires_at_timestamp = int(time.time()) + 3600
 
+        # Create credential object
         sts_credential = AssumeRoleCredential(
             access_key_id=credentials.access_key_id,
             secret_access_key=credentials.secret_access_key,
             session_token=credentials.session_token,
         )
 
-        # Cached credentials and expiration time
+        # Cache credentials and expiration time
         self._cached_sts_credential = sts_credential
         self._sts_credential_expires_at = expires_at_timestamp
 

{veadk_python-0.2.25 → veadk_python-0.2.27}/veadk/knowledgebase/backends/vikingdb_knowledge_backend.py

@@ -137,7 +137,7 @@ class VikingDBKnowledgeBackend(BaseKnowledgebaseBackend):
                 "it must start with an English letter, contain only letters, numbers, and underscores, and have a length of 1-128."
             )
 
-    def _get_tos_client(self) -> VeTOS:
+    def _get_tos_client(self, tos_bucket_name: str) -> VeTOS:
         volcengine_access_key = self.volcengine_access_key
         volcengine_secret_key = self.volcengine_secret_key
         session_token = self.session_token
@@ -153,7 +153,7 @@ class VikingDBKnowledgeBackend(BaseKnowledgebaseBackend):
             sk=volcengine_secret_key,
             session_token=session_token,
             region=self.tos_config.region,
-            bucket_name=self.tos_config.bucket,
+            bucket_name=tos_bucket_name or self.tos_config.bucket,
         )
 
     @override
@@ -461,7 +461,7 @@ class VikingDBKnowledgeBackend(BaseKnowledgebaseBackend):
         metadata: dict | None = None,
     ) -> str:
         # Here, we set the metadata via the TOS object, ref: https://www.volcengine.com/docs/84313/1254624
-        self._tos_client = self._get_tos_client()
+        self._tos_client = self._get_tos_client(tos_bucket_name)
 
         self._tos_client.bucket_name = tos_bucket_name
         coro = self._tos_client.upload(

{veadk_python-0.2.25 → veadk_python-0.2.27}/veadk/utils/misc.py

@@ -137,19 +137,20 @@ def set_envs(config_yaml_path: str, env_from_dotenv: dict = None) -> tuple[dict,
         config_dict = safe_load(yaml_file)
 
     flatten_config_dict = flatten_dict(config_dict)
-
-    veadk_environments = dict(env_from_dotenv)
-    for k, v in flatten_config_dict.items():
-        k = k.upper()
-
-        if k in env_from_dotenv:
+    config_upper_map = {k.upper(): v for k, v in flatten_config_dict.items()}
+    all_keys = {k.upper() for k in flatten_config_dict.keys()} | set(
+        env_from_dotenv.keys() if env_from_dotenv else []
+    )
+    veadk_environments = {}
+    for k in all_keys:
+        if k in os.environ:
             logger.info(
-                f"Environment variable {k} has been set in .env, value in `config.yaml` will be ignored."
+                f"Environment variable {k} has been set, value in `config.yaml` will be ignored."
             )
+            veadk_environments[k] = os.environ[k]
             continue
-        veadk_environments[k] = str(v)
-        os.environ[k] = str(v)
-
+        veadk_environments[k] = str(config_upper_map.get(k))
+        os.environ[k] = str(config_upper_map.get(k))
     return config_dict, veadk_environments
 
 

{veadk_python-0.2.25 → veadk_python-0.2.27}/veadk/version.py

@@ -12,4 +12,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-VERSION = "0.2.25"
+VERSION = "0.2.27"

{veadk_python-0.2.25 → veadk_python-0.2.27/veadk_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: veadk-python
-Version: 0.2.25
+Version: 0.2.27
 Summary: Volcengine agent development kit, integrations with Volcengine cloud services.
 Author-email: Yaozheng Fang <fangyozheng@gmail.com>, Guodong Li <cu.eric.lee@gmail.com>, Zhi Han <sliverydayday@gmail.com>, Meng Wang <mengwangwm@gmail.com>
 License:                                  Apache License