nebius.aio.cli_config.Config

class documentation

class Config: (source)

Constructor: Config(client_id, config_file, profile, profile_env, ...)

Reader for Nebius CLI-style configuration files.

The Config class locates and parses a YAML-based configuration file (by default under ~/.nebius/config.yaml) and exposes convenience methods to obtain the default parent id, endpoint, and credentials configured for the active profile.

Example

Initialize the SDK with CLI config:

from nebius.sdk import SDK
from nebius.aio.cli_config import Config

# Initialize SDK with CLI config reader
sdk = SDK(config_reader=Config())

# The config reader will automatically handle authentication
# based on the active CLI profile

# You can also access config properties directly
config = Config()
print(f"Default parent ID: {config.parent_id}")
print(f"Endpoint: {config.endpoint()}")

Parameters
client_id	Optional client id used for federation flows.
config_file	Path to the configuration YAML file.
profile	Optional profile name to select; when omitted the default profile from the config or the environment variable indicated by `profile_env` is used.
profile_env	Environment variable name used to select a profile.
token_env	Environment variable name that may contain an IAM token and will take priority over file-based credentials.
no_env	If True skip environment token lookup, profile selection, and endpoint override. If you want to disable only one of these features, you can set the env variable name to some invalid value.
no_parent_id	If True disable automatic parent id resolution.
max_retries	Maximum number of auth retries when interacting with external services (passed to underlying bearers).
endpoint	Optional endpoint URL to override profile setting.
endpoint_env	Environment variable name used to override the endpoint URL from the profile.
metrics	Optional callback object or mapping that receives config metrics from this reader and auth metrics from credentials it creates. The last `config_load` event is replayed when metrics are attached later via `set_metrics`.
auth_metrics	Optional callback object or mapping for auth-only metrics emitted by credentials returned from `get_credentials`. Ignored when `metrics` is provided because full metrics are reused for auth callbacks.
impersonate_service_account_id	Optional service account id to impersonate. Overrides `impersonate-service-account-id` from the selected profile.

Method	`__init__`	Initialize the config reader, and read the config file, selecting the active profile.
Method	`endpoint`	Return the configured endpoint for the active profile.
Method	`get_credentials`	Resolve and return credentials for the active profile.
Method	`profile_name`	Return the selected profile name.
Method	`set_auth_metrics`	Attach auth-only metrics used by credentials returned later.
Method	`set_metrics`	Attach full config/auth metrics and replay the last config load.
Property	`parent_id`	Return the parent id from the active profile.
Method	`_add_impersonation_if_set`	Wrap token credentials with service-account impersonation if configured.
Method	`_get_profile`	Get the profile from the config file.
Method	`_record_metric`	Undocumented
Instance Variable	`_auth_metrics`	Undocumented
Instance Variable	`_client_id`	Undocumented
Instance Variable	`_config_file`	Undocumented
Instance Variable	`_endpoint`	Undocumented
Instance Variable	`_impersonate_service_account_id`	Undocumented
Instance Variable	`_last_config_load_metric`	Undocumented
Instance Variable	`_max_retries`	Undocumented
Instance Variable	`_metrics`	Undocumented
Instance Variable	`_no_parent_id`	Undocumented
Instance Variable	`_priority_bearer`	Undocumented
Instance Variable	`_profile`	Undocumented
Instance Variable	`_profile_name`	Undocumented

def __init__(self, client_id: str | None = None, config_file: str | Path = Path(DEFAULT_CONFIG_DIR) / DEFAULT_CONFIG_FILE, profile: str | None = None, profile_env: str = PROFILE_ENV, token_env: str = TOKEN_ENV, no_env: bool = False, no_parent_id: bool = False, max_retries: int = 2, endpoint: str | None = None, endpoint_env: str = ENDPOINT_ENV, metrics: MetricsLike = None, auth_metrics: AuthMetricsLike = None, impersonate_service_account_id: str | None = None): (source) ¶

Initialize the config reader, and read the config file, selecting the active profile.

metrics receives both configuration metrics and auth metrics for credentials created by this reader. auth_metrics receives only auth metrics and is used only when metrics is not provided.

def endpoint(self) -> str: (source) ¶

Return the configured endpoint for the active profile.

If the profile does not define an endpoint this method returns an empty string.

Returns
`str`	endpoint string or empty string when not configured

def get_credentials(self, channel: ClientChannelInterface, writer: TextIO | None = None, no_browser_open: bool = False, ssl_ctx: SSLContext | None = None) -> Credentials: (source) ¶

Resolve and return credentials for the active profile.

This method consults, in order of priority:

An environment-provided token bearer (if present and enabled).
A token file specified by token-file in the profile.
The profile's auth-type which may be federation or service account and will create the corresponding bearer implementation.

The returned object is suitable to be consumed by nebius.aio.channel.Channel and may be one of nebius.aio.authorization.authorization.Provider, a nebius.aio.token.token.Bearer, a TokenRequester reader, a low-level nebius.aio.token.token.Token, or a raw string token depending on the profile and environment.

Parameters
channel:`ClientChannelInterface`	channel instance used for network-bound credential flows
writer:optional `TextIO`	optional text stream used by interactive flows (federation)
no_browser_open:`bool`	when True, federation flows will not open browsers
ssl_ctx:optional `SSLContext`	optional SSLContext forwarded to federation flows
Returns
`Provider`, `nebius.aio.token.token.Bearer`, `TokenRequester`, `Token` or `str`	a credentials object appropriate for the active profile
Raises
`ConfigError`	for malformed or missing profile entries

def profile_name(self) -> str | None: (source) ¶

Return the selected profile name.

def set_auth_metrics(self, metrics: AuthMetricsLike): (source) ¶

Attach auth-only metrics used by credentials returned later.

This does not emit or replay config-reader metrics. Use set_metrics when the same sink should receive both config and auth events.

def set_metrics(self, metrics: MetricsLike): (source) ¶

Attach full config/auth metrics and replay the last config load.

The same callback object is propagated to credentials returned later so token acquisition, refresh, and cache events share the same sink.

@property
parent_id: str = (source) ¶

Return the parent id from the active profile.

The value is read from the active profile's parent-id field and validated to be a non-empty string.

Returns
the parent id configured for the active profile
Raises
`NoParentIdError`	if parent id usage is disabled or the value is missing or empty in the profile
`ConfigError`	if the profile contains a non-string parent-id

def _add_impersonation_if_set(self, credentials: Credentials, channel: ClientChannelInterface) -> Credentials: (source) ¶

Wrap token credentials with service-account impersonation if configured.

def _get_profile(self): (source) ¶

Get the profile from the config file.

def _record_metric(self, kind: Literal['config_load', 'credentials_resolve'], source: str, result: MetricResult, duration_seconds: float): (source) ¶

Undocumented

_auth_metrics = (source) ¶

Undocumented

_client_id = (source) ¶

Undocumented

_config_file = (source) ¶

Undocumented

_endpoint: str | None = (source) ¶

Undocumented

_impersonate_service_account_id = (source) ¶

Undocumented