ellf-cli 18.0.40__tar.gz → 18.0.41__tar.gz

{ellf_cli-18.0.40/ellf_cli.egg-info → ellf_cli-18.0.41}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ellf-cli
-Version: 18.0.40
+Version: 18.0.41
 Summary: Ellf Command Line Interface
 Home-page: https://prodi.gy
 Author: ExplosionAI GmbH

{ellf_cli-18.0.40 → ellf_cli-18.0.41}/ellf_cli/cluster_config.py

@@ -93,6 +93,14 @@ class ClusterConfig(BaseModel):
         enable_cost_collection: bool = False
         billing_export: dict[str, str] | None = None
         cost_view_table: str = ""
+        # The cluster's object storage, backfilled from the terraform outputs
+        # of the same names and served by the broker as {__cloud_storage__}.
+        # cloud_storage_account_url and workload_identity_client_id are
+        # Azure only: an az:// URL doesn't name its storage account, and AKS
+        # federates the service account through an explicit client ID.
+        cloud_storage_url: str = ""
+        cloud_storage_account_url: str = ""
+        workload_identity_client_id: str = ""
         model_config = {"populate_by_name": True}
 
         @model_validator(mode="after")
@@ -186,6 +194,9 @@ class ClusterConfigOverrides(BaseModel):
         enable_cost_collection: bool | None = None
         billing_export: dict[str, str] | None = None
         cost_view_table: str | None = None
+        cloud_storage_url: str | None = None
+        cloud_storage_account_url: str | None = None
+        workload_identity_client_id: str | None = None
         model_config = {"populate_by_name": True}
 
         @property

{ellf_cli-18.0.40 → ellf_cli-18.0.41}/ellf_cli/commands/infra/_config_io.py

@@ -34,6 +34,12 @@ TF_DEPLOYMENT_OUTPUTS = {
     # GCP only — the aws/azure workspaces have no ingress address output; the
     # LB there is created by traefik at `infra start` time.
     "ingress_ip": "public_ip",
+    # GCP only, and null unless enable_cost_collection is set.
+    "cost_view_table": "cost_view_table",
+    "cloud_storage_url": "cloud_storage_url",
+    # Azure only.
+    "cloud_storage_account_url": "cloud_storage_account_url",
+    "workload_identity_client_id": "workload_identity_client_id",
 }
 TF_DATABASE_OUTPUTS = {
     "database_ip": "ip",

{ellf_cli-18.0.40 → ellf_cli-18.0.41}/ellf_cli/commands/infra/_helpers.py

@@ -41,17 +41,20 @@ class ClusterCredsFile(BaseModel):
     target_cpl_version: str = ""
 
 
-# Toleration for the system node-pool taint applied by the GKE terraform
-# module. Platform components (broker, traefik, cert-manager) must carry
-# this so they can still schedule on the system pool; recipe Jobs lack it
-# and therefore cannot accidentally land there.
+# Tolerations for the system node-pool taint the terraform modules apply:
+# ellf/role=system on GKE and EKS, and AKS's own CriticalAddonsOnly on AKS,
+# whose default pool can carry no other. Platform components (broker,
+# traefik, cert-manager) must carry these so they can still schedule on the
+# system pool; recipe Jobs lack them and therefore cannot accidentally land
+# there.
 SYSTEM_NODE_TOLERATIONS = [
     {
         "key": "ellf/role",
         "operator": "Equal",
         "value": "system",
         "effect": "NoSchedule",
-    }
+    },
+    {"key": "CriticalAddonsOnly", "operator": "Exists"},
 ]
 
 

{ellf_cli-18.0.40 → ellf_cli-18.0.41}/ellf_cli/commands/infra/init_values.py

@@ -149,6 +149,7 @@ def init_values(
             "prodigyLicenseKey": prodigy_license_key,
         }
         values["nfs"] = {"claimName": "prodigy-nfs"}
+        values["cloudStorage"] = {"url": "FILL-IN-from-terraform-output"}
     elif cloud_provider == "aws":
         # The terraform workspace outputs a per-cluster registry the nodes
         # can push to ('terraform output container_registry').
@@ -165,6 +166,7 @@ def init_values(
             "prodigyLicenseKey": prodigy_license_key,
         }
         values["nfs"] = {"claimName": "prodigy-nfs"}
+        values["cloudStorage"] = {"url": "FILL-IN-from-terraform-output"}
     elif cloud_provider == "azure":
         # The terraform workspace outputs a per-cluster registry the nodes
         # can push to ('terraform output container_registry').
@@ -191,6 +193,11 @@ def init_values(
             "prodigyLicenseKey": prodigy_license_key,
         }
         values["nfs"] = {"claimName": "prodigy-nfs"}
+        values["cloudStorage"] = {
+            "url": "FILL-IN-from-terraform-output",
+            "accountUrl": "FILL-IN-from-terraform-output",
+            "azureWorkloadIdentityClientId": "FILL-IN-from-terraform-output",
+        }
     srsly.write_yaml(out, values)
     msg.good(f"Generated {out}")
     msg.info(

{ellf_cli-18.0.40 → ellf_cli-18.0.41}/ellf_cli/ellf.json

@@ -1,7 +1,7 @@
 {
   "prog": "ellf",
   "help": "Ellf Command Line Interface.",
-  "version": "18.0.40",
+  "version": "18.0.41",
   "extra_key": "_extra",
   "commands": {
     "actions": {
@@ -283,7 +283,7 @@
           "orig_type": "bool"
         }
       ],
-      "description": "\n    Log in to your Ellf account. You normally don't need to call this\n    manually. It will automatically authenticate when needed.\n    ",
+      "description": "\nLog in to your Ellf account. You normally don't need to call this\nmanually. It will automatically authenticate when needed.\n",
       "allow_extra": false,
       "parent": null,
       "is_placeholder": false
@@ -318,7 +318,7 @@
           "orig_type": "bool"
         }
       ],
-      "description": "\n    Log out by deleting locally-stored auth tokens.\n\n    PAM bearer tokens can't be revoked server-side, so this is a local\n    operation: subsequent commands will trigger a fresh device-flow\n    login. The cached tokens would have expired on their own within\n    roughly an hour. Use ``--all`` to also reset the saved defaults\n    (active org, cluster, project, etc.), e.g. when handing the\n    machine to a different user.\n    ",
+      "description": "\nLog out by deleting locally-stored auth tokens.\n\nPAM bearer tokens can't be revoked server-side, so this is a local\noperation: subsequent commands will trigger a fresh device-flow\nlogin. The cached tokens would have expired on their own within\nroughly an hour. Use ``--all`` to also reset the saved defaults\n(active org, cluster, project, etc.), e.g. when handing the\nmachine to a different user.\n",
       "allow_extra": false,
       "parent": null,
       "is_placeholder": false
@@ -372,7 +372,7 @@
           "orig_type": "Literal[api, cluster, id, ci, ellf-core]"
         }
       ],
-      "description": "\n    Return an auth token for the current user\n    ",
+      "description": "\nReturn an auth token for the current user\n",
       "allow_extra": false,
       "parent": null,
       "is_placeholder": false
@@ -450,7 +450,7 @@
           "orig_type": "list[Literal[tasks, actions, agents, services, assets, datasets, paths]]"
         }
       ],
-      "description": "\n    Save the state of the current app JSON file. If an assets directory is\n    provided, assets will be downloaded and referenced in the JSON accordingly.\n    ",
+      "description": "\nSave the state of the current app JSON file. If an assets directory is\nprovided, assets will be downloaded and referenced in the JSON accordingly.\n",
       "allow_extra": false,
       "parent": null,
       "is_placeholder": false
@@ -485,7 +485,7 @@
           "orig_type": "bool"
         }
       ],
-      "description": "\n    Populate Ellf with data for projects, tasks, actions, agents, services,\n    assets, datasets and paths.\n    ",
+      "description": "\nPopulate Ellf with data for projects, tasks, actions, agents, services,\nassets, datasets and paths.\n",
       "allow_extra": false,
       "parent": null,
       "is_placeholder": false
@@ -575,7 +575,7 @@
             "orig_type": "List[str]"
           }
         ],
-        "description": "\n    Create a new action. The available action recipes are fetched from your\n    cluster and are added as dynamic subcommands. You can see more details\n    and available arguments by calling the subcommand with --help, e.g. create\n    [name] --help\n    ",
+        "description": "\nCreate a new action. The available action recipes are fetched from your\ncluster and are added as dynamic subcommands. You can see more details\nand available arguments by calling the subcommand with --help, e.g. create\n[name] --help\n",
         "allow_extra": true,
         "parent": "actions",
         "is_placeholder": false
@@ -623,7 +623,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "\n    List the actions in a project. Uses your default project unless --project\n    is given. By default, this includes their ID, name and current state,\n    e.g. created or completed\n    ",
+        "description": "\nList the actions in a project. Uses your default project unless --project\nis given. By default, this includes their ID, name and current state,\ne.g. created or completed\n",
         "allow_extra": false,
         "parent": "actions",
         "is_placeholder": false
@@ -1082,7 +1082,7 @@
             "orig_type": "List[str]"
           }
         ],
-        "description": "\n    Create a new agent. The available agent recipes are fetched from your\n    cluster and are added as dynamic subcommands. You can see more details\n    and available arguments by calling the subcommand with --help, e.g. create\n    [name] --help\n    ",
+        "description": "\nCreate a new agent. The available agent recipes are fetched from your\ncluster and are added as dynamic subcommands. You can see more details\nand available arguments by calling the subcommand with --help, e.g. create\n[name] --help\n",
         "allow_extra": true,
         "parent": "agents",
         "is_placeholder": false
@@ -1230,7 +1230,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "\n    Remove an agent from a task. This will only remove the assignment and keep\n    all annotations the agent has created.\n    ",
+        "description": "\nRemove an agent from a task. This will only remove the assignment and keep\nall annotations the agent has created.\n",
         "allow_extra": false,
         "parent": "agents",
         "is_placeholder": false
@@ -1278,7 +1278,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "\n    List the agents in a project. Uses your default project unless --project\n    is given. By default, this includes their ID, name and current state,\n    e.g. created or completed\n    ",
+        "description": "\nList the agents in a project. Uses your default project unless --project\nis given. By default, this includes their ID, name and current state,\ne.g. created or completed\n",
         "allow_extra": false,
         "parent": "agents",
         "is_placeholder": false
@@ -1772,7 +1772,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "\n    Get detailed info for an asset uploaded to the cluster and registered\n    with Ellf\n    ",
+        "description": "\nGet detailed info for an asset uploaded to the cluster and registered\nwith Ellf\n",
         "allow_extra": false,
         "parent": "assets",
         "is_placeholder": false
@@ -1872,7 +1872,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "\n    Create an asset on the cluster and register it with Ellf. Assets\n    point to files or directories you control. The Ellf server only has\n    a reference to them. This command doesn't transfer any data. See `ellf files`\n    for utilities to transfer files to and from your cluster\n    ",
+        "description": "\nCreate an asset on the cluster and register it with Ellf. Assets\npoint to files or directories you control. The Ellf server only has\na reference to them. This command doesn't transfer any data. See `ellf files`\nfor utilities to transfer files to and from your cluster\n",
         "allow_extra": false,
         "parent": "assets",
         "is_placeholder": false
@@ -1943,7 +1943,7 @@
       "import": {
         "name": "import",
         "args": [],
-        "description": "Read a serialised FileSecrets blob from stdin and write it to\n    the local secrets file.\n\n    Counterpart to ``ellf auth push``. Existing local auth state is\n    overwritten; the file is written 0600 by FileSecrets.save.\n    ",
+        "description": "Read a serialised FileSecrets blob from stdin and write it to\nthe local secrets file.\n\nCounterpart to ``ellf auth push``. Existing local auth state is\noverwritten; the file is written 0600 by FileSecrets.save.\n",
         "allow_extra": false,
         "parent": "auth",
         "is_placeholder": false
@@ -1978,7 +1978,7 @@
             "orig_type": "str"
           }
         ],
-        "description": "Push local auth state to a remote machine via SSH.\n\n    Reads the local FileSecrets, JSON-serialises it, and pipes it to\n    ``<remote_ellf> auth import`` over an SSH connection to *host*.\n    Authentication is delegated to ssh \u2014 anything in your ssh config\n    (host aliases, ProxyJump, key-based auth) just works.\n\n    The pushed blob includes id_token, api_token, and any cached\n    broker_tokens. id_token expiry is dictated by the issuer (typically\n    ~1h), so this is a \"give the remote a usable session\" operation,\n    not a permanent provisioning. Re-run when the token expires.\n    ",
+        "description": "Push local auth state to a remote machine via SSH.\n\nReads the local FileSecrets, JSON-serialises it, and pipes it to\n``<remote_ellf> auth import`` over an SSH connection to *host*.\nAuthentication is delegated to ssh \u2014 anything in your ssh config\n(host aliases, ProxyJump, key-based auth) just works.\n\nThe pushed blob includes id_token, api_token, and any cached\nbroker_tokens. id_token expiry is dictated by the issuer (typically\n~1h), so this is a \"give the remote a usable session\" operation,\nnot a permanent provisioning. Re-run when the token expires.\n",
         "allow_extra": false,
         "parent": "auth",
         "is_placeholder": false
@@ -2050,7 +2050,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Switch the active cluster.\n\n    Looks up the cluster by name or ID via PAM. With no argument and\n    multiple clusters available, prompts interactively in a TTY.\n    ",
+        "description": "Switch the active cluster.\n\nLooks up the cluster by name or ID via PAM. With no argument and\nmultiple clusters available, prompts interactively in a TTY.\n",
         "allow_extra": false,
         "parent": "clusters",
         "is_placeholder": false
@@ -2194,7 +2194,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "\n    Delete a cluster from PAM. This only removes PAM's record\n    of it. The cluster itself will continue to exist - you need\n    to shut it down separately.\n    ",
+        "description": "\nDelete a cluster from PAM. This only removes PAM's record\nof it. The cluster itself will continue to exist - you need\nto shut it down separately.\n",
         "allow_extra": false,
         "parent": "clusters",
         "is_placeholder": false
@@ -2294,7 +2294,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Check the health of a cluster deployment.\n\n    Runs CLI-side connectivity checks against the cluster and PAM.\n    Use --deep (or supply --s3-bucket / --nfs-path / --recipe) to also\n    trigger cluster-side deployment checks via the broker's /v1/check\n    endpoints (K8s API, NFS, S3, recipe execution, DB).\n    ",
+        "description": "Check the health of a cluster deployment.\n\nRuns CLI-side connectivity checks against the cluster and PAM.\nUse --deep (or supply --s3-bucket / --nfs-path / --recipe) to also\ntrigger cluster-side deployment checks via the broker's /v1/check\nendpoints (K8s API, NFS, S3, recipe execution, DB).\n",
         "allow_extra": false,
         "parent": "clusters",
         "is_placeholder": false
@@ -2390,7 +2390,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Rotate the cluster RSA keypair.\n\n    Generates a new keypair, updates the cluster record in PAM with the\n    new public key, patches the K8s secret with the new private key,\n    and restarts the cluster deployment.\n    ",
+        "description": "Rotate the cluster RSA keypair.\n\nGenerates a new keypair, updates the cluster record in PAM with the\nnew public key, patches the K8s secret with the new private key,\nand restarts the cluster deployment.\n",
         "allow_extra": false,
         "parent": "clusters",
         "is_placeholder": false
@@ -3201,7 +3201,7 @@
             "orig_type": "str"
           }
         ],
-        "description": "Export all the examples from a dataset and save it in the designated file as\n    JSONL (newline-delimited JSON).\n    ",
+        "description": "Export all the examples from a dataset and save it in the designated file as\nJSONL (newline-delimited JSON).\n",
         "allow_extra": false,
         "parent": "datasets",
         "is_placeholder": false
@@ -3675,7 +3675,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Register a new cluster with PAM and write credentials to cluster-creds.json.\n\n    Pass --domain to use your own DNS, or omit it to be allocated a managed\n    subdomain (with base + wildcard A records) under an Explosion-controlled\n    zone.\n    ",
+        "description": "Register a new cluster with PAM and write credentials to cluster-creds.json.\n\nPass --domain to use your own DNS, or omit it to be allocated a managed\nsubdomain (with base + wildcard A records) under an Explosion-controlled\nzone.\n",
         "allow_extra": false,
         "parent": "infra",
         "is_placeholder": false
@@ -3775,7 +3775,7 @@
             "orig_type": "str"
           }
         ],
-        "description": "Create a versioned bucket for terraform remote state and record it in\n    config.yaml (or print the block to add when no config file exists).\n\n    Remote state is the recommended setup: local state is owned by whichever\n    disk ran terraform, so it's easy to lose and impossible to share. The\n    bucket is managed outside the terraform on purpose \u2014 it must exist before\n    terraform runs and outlive the cluster so 'infra destroy' has state to\n    work against; nothing here (or in destroy) ever deletes it. Uses the\n    aws / gcloud CLI, which the terraform flow already relies on for\n    credentials.\n    ",
+        "description": "Create a versioned bucket for terraform remote state and record it in\nconfig.yaml (or print the block to add when no config file exists).\n\nRemote state is the recommended setup: local state is owned by whichever\ndisk ran terraform, so it's easy to lose and impossible to share. The\nbucket is managed outside the terraform on purpose \u2014 it must exist before\nterraform runs and outlive the cluster so 'infra destroy' has state to\nwork against; nothing here (or in destroy) ever deletes it. Uses the\naws / gcloud CLI, which the terraform flow already relies on for\ncredentials.\n",
         "allow_extra": false,
         "parent": "infra",
         "is_placeholder": false
@@ -3897,7 +3897,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Apply terraform to create or update cluster infrastructure.\n\n    Returns True when an apply actually ran \u2014 'infra provision' wraps this\n    and only backfills config.yaml from outputs after a real apply.\n    ",
+        "description": "Apply terraform to create or update cluster infrastructure.\n\nReturns True when an apply actually ran \u2014 'infra provision' wraps this\nand only backfills config.yaml from outputs after a real apply.\n",
         "allow_extra": false,
         "parent": "infra",
         "is_placeholder": false
@@ -3958,7 +3958,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Destroy the cluster infrastructure created by 'infra terraform'.\n\n    Note this never touches the terraform state bucket: the bucket is managed\n    outside the terraform (see 'infra init --state-bucket') and outlives the\n    cluster so the destroy itself has state to work against.\n    ",
+        "description": "Destroy the cluster infrastructure created by 'infra terraform'.\n\nNote this never touches the terraform state bucket: the bucket is managed\noutside the terraform (see 'infra init --state-bucket') and outlives the\ncluster so the destroy itself has state to work against.\n",
         "allow_extra": false,
         "parent": "infra",
         "is_placeholder": false
@@ -4227,7 +4227,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Initialize a cluster: register with PAM (allocating a managed domain\n    unless --domain is given), download the terraform files, and generate\n    config.yaml \u2014 the input every later phase (configure, provision, start)\n    reads. Idempotent and safe to re-run.\n\n    After init, the directory is a complete hand-off bundle (terraform files\n    + terraform.tfvars.json + config.yaml) for teams that apply terraform\n    through their own pipeline; they later sync outputs back with\n    'ellf infra configure --from-terraform' instead of 'ellf infra provision'.\n    ",
+        "description": "Initialize a cluster: register with PAM (allocating a managed domain\nunless --domain is given), download the terraform files, and generate\nconfig.yaml \u2014 the input every later phase (configure, provision, start)\nreads. Idempotent and safe to re-run.\n\nAfter init, the directory is a complete hand-off bundle (terraform files\n+ terraform.tfvars.json + config.yaml) for teams that apply terraform\nthrough their own pipeline; they later sync outputs back with\n'ellf infra configure --from-terraform' instead of 'ellf infra provision'.\n",
         "allow_extra": false,
         "parent": "infra",
         "is_placeholder": false
@@ -4483,7 +4483,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Update the config.yaml written by 'ellf infra init' \u2014 repeatable, so no\n    decision made at init time is final. With no flags on a terminal, re-runs\n    the provider prompts with the current values as defaults.",
+        "description": "Update the config.yaml written by 'ellf infra init' \u2014 repeatable, so no\ndecision made at init time is final. With no flags on a terminal, re-runs\nthe provider prompts with the current values as defaults.",
         "allow_extra": false,
         "parent": "infra",
         "is_placeholder": false
@@ -4544,7 +4544,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Deploy or upgrade the Ellf Helm chart.\n\n    Creates the namespace, image pull secret, cluster keypair secret,\n    then runs helm upgrade --install with the provided values. The broker\n    and cpl image versions come from PAM's cluster settings at deploy time\n    \u2014 the same targets the CPL sidecar auto-updates the running cluster to\n    \u2014 so a deploy can never roll an auto-updated cluster back.\n    ",
+        "description": "Deploy or upgrade the Ellf Helm chart.\n\nCreates the namespace, image pull secret, cluster keypair secret,\nthen runs helm upgrade --install with the provided values. The broker\nand cpl image versions come from PAM's cluster settings at deploy time\n\u2014 the same targets the CPL sidecar auto-updates the running cluster to\n\u2014 so a deploy can never roll an auto-updated cluster back.\n",
         "allow_extra": false,
         "parent": "infra",
         "is_placeholder": false
@@ -4692,7 +4692,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Provision the cluster infrastructure: terraform init + plan + apply,\n    then backfill config.yaml from the outputs and point the managed domain\n    at the ingress IP (where the provider exposes one). Requires a terraform\n    state location \u2014 see 'ellf infra init --state-bucket' / 'ellf infra\n    configure --state-bucket'; the state bucket itself is managed outside\n    the terraform and is never touched here or by 'infra destroy'.",
+        "description": "Provision the cluster infrastructure: terraform init + plan + apply,\nthen backfill config.yaml from the outputs and point the managed domain\nat the ingress IP (where the provider exposes one). Requires a terraform\nstate location \u2014 see 'ellf infra init --state-bucket' / 'ellf infra\nconfigure --state-bucket'; the state bucket itself is managed outside\nthe terraform and is never touched here or by 'infra destroy'.",
         "allow_extra": false,
         "parent": "infra",
         "is_placeholder": false
@@ -4753,7 +4753,7 @@
             "orig_type": "str"
           }
         ],
-        "description": "Install cluster infrastructure prerequisites (Traefik, cert-manager).\n\n    These operations are idempotent and safe to re-run.\n    ",
+        "description": "Install cluster infrastructure prerequisites (Traefik, cert-manager).\n\nThese operations are idempotent and safe to re-run.\n",
         "allow_extra": false,
         "parent": "infra",
         "is_placeholder": false
@@ -4914,7 +4914,7 @@
             "orig_type": "str"
           }
         ],
-        "description": "Manage TLS certificates for local cluster access.\n\n    Use --self-signed when you have direct kubectl access to the cluster.\n    Use --setup HOST to do everything from your laptop over SSH.\n    Use --trust HOST to fetch and install an existing CA from a remote cluster.\n    ",
+        "description": "Manage TLS certificates for local cluster access.\n\nUse --self-signed when you have direct kubectl access to the cluster.\nUse --setup HOST to do everything from your laptop over SSH.\nUse --trust HOST to fetch and install an existing CA from a remote cluster.\n",
         "allow_extra": false,
         "parent": "infra",
         "is_placeholder": false
@@ -4938,7 +4938,7 @@
             "orig_type": "str"
           }
         ],
-        "description": "\n    Run a job directly on the cluster from a YAML spec file, bypassing PAM.\n    ",
+        "description": "\nRun a job directly on the cluster from a YAML spec file, bypassing PAM.\n",
         "allow_extra": false,
         "parent": "jobs",
         "is_placeholder": false
@@ -4986,7 +4986,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "\n    List the workloads running on your cluster. This reads the cluster directly,\n    so it also shows orphaned workloads that have no matching task, action,\n    agent or service in Ellf.\n    ",
+        "description": "\nList the workloads running on your cluster. This reads the cluster directly,\nso it also shows orphaned workloads that have no matching task, action,\nagent or service in Ellf.\n",
         "allow_extra": false,
         "parent": "jobs",
         "is_placeholder": false
@@ -5034,7 +5034,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "\n    Stop a job on the cluster by its ID. Works for workloads that have no\n    matching job in Ellf, which the stop commands of tasks, actions, agents and\n    services cannot reach.\n    ",
+        "description": "\nStop a job on the cluster by its ID. Works for workloads that have no\nmatching job in Ellf, which the stop commands of tasks, actions, agents and\nservices cannot reach.\n",
         "allow_extra": false,
         "parent": "jobs",
         "is_placeholder": false
@@ -6125,7 +6125,7 @@
             "orig_type": "str"
           }
         ],
-        "description": "\n    Upload and advertise a recipes package from your Python environment.\n    ",
+        "description": "\nUpload and advertise a recipes package from your Python environment.\n",
         "allow_extra": false,
         "parent": "publish",
         "is_placeholder": false
@@ -6264,7 +6264,7 @@
             "orig_type": "str"
           }
         ],
-        "description": "\n    Transfer data to the cluster, and advertise it to Ellf.\n\n    These steps can also be done separately. See `ellf files` to transfer\n    data to the cluster without creating an Asset record for it, and\n    `ellf assets create` to create an Asset without transfer.\n    ",
+        "description": "\nTransfer data to the cluster, and advertise it to Ellf.\n\nThese steps can also be done separately. See `ellf files` to transfer\ndata to the cluster without creating an Asset record for it, and\n`ellf assets create` to create an Asset without transfer.\n",
         "allow_extra": false,
         "parent": "publish",
         "is_placeholder": false
@@ -6349,7 +6349,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Export recipes from the cluster to a local YAML or JSON file.\n\n    Exports every package by default. Use --packages to export only certain\n    ones, e.g. to keep ad-hoc packages published to the cluster out of the\n    docs.\n    ",
+        "description": "Export recipes from the cluster to a local YAML or JSON file.\n\nExports every package by default. Use --packages to export only certain\nones, e.g. to keep ad-hoc packages published to the cluster out of the\ndocs.\n",
         "allow_extra": false,
         "parent": "recipes",
         "is_placeholder": false
@@ -6832,7 +6832,7 @@
             "orig_type": "List[str]"
           }
         ],
-        "description": "\n    Create a new service. The available service recipes are fetched from your\n    cluster and are added as dynamic subcommands. You can see more details\n    and available arguments by calling the subcommand with --help, e.g. create\n    [name] --help\n    ",
+        "description": "\nCreate a new service. The available service recipes are fetched from your\ncluster and are added as dynamic subcommands. You can see more details\nand available arguments by calling the subcommand with --help, e.g. create\n[name] --help\n",
         "allow_extra": true,
         "parent": "services",
         "is_placeholder": false
@@ -6880,7 +6880,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "\n    List the services in a project. Uses your default project unless\n    --project is given.\n    ",
+        "description": "\nList the services in a project. Uses your default project unless\n--project is given.\n",
         "allow_extra": false,
         "parent": "services",
         "is_placeholder": false
@@ -7311,7 +7311,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Print the bearer-token-authenticated URL for a service.\n\n    Mints a fresh 90-day token via ``POST /v1/service/issue-token`` and\n    formats it together with the service's public URL so the result can\n    be dropped into an MCP client config or curl invocation:\n\n        curl -H \"Authorization: Bearer <token>\" <url>\n\n    Use ``services rotate-token`` to mint a new token without printing\n    the URL again.\n    ",
+        "description": "Print the bearer-token-authenticated URL for a service.\n\nMints a fresh 90-day token via ``POST /v1/service/issue-token`` and\nformats it together with the service's public URL so the result can\nbe dropped into an MCP client config or curl invocation:\n\n    curl -H \"Authorization: Bearer <token>\" <url>\n\nUse ``services rotate-token`` to mint a new token without printing\nthe URL again.\n",
         "allow_extra": false,
         "parent": "services",
         "is_placeholder": false
@@ -7372,7 +7372,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Mint a fresh 90-day token for an existing service.\n\n    Issuing a new token does not invalidate previous ones -- they remain\n    valid until their own expiration. Use this when the previous token\n    is leaked, or when you want a longer remaining window for an MCP\n    client config.\n    ",
+        "description": "Mint a fresh 90-day token for an existing service.\n\nIssuing a new token does not invalidate previous ones -- they remain\nvalid until their own expiration. Use this when the previous token\nis leaked, or when you want a longer remaining window for an MCP\nclient config.\n",
         "allow_extra": false,
         "parent": "services",
         "is_placeholder": false
@@ -7592,7 +7592,7 @@
             "orig_type": "List[str]"
           }
         ],
-        "description": "\n    Create a new task. The available task recipes are fetched from your\n    cluster and are added as dynamic subcommands. You can see more details\n    and available arguments by calling the subcommand with --help, e.g. create\n    [name] --help\n    ",
+        "description": "\nCreate a new task. The available task recipes are fetched from your\ncluster and are added as dynamic subcommands. You can see more details\nand available arguments by calling the subcommand with --help, e.g. create\n[name] --help\n",
         "allow_extra": true,
         "parent": "tasks",
         "is_placeholder": false
@@ -7640,7 +7640,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "\n    List the tasks in a project. Uses your default project unless --project\n    is given. By default, this includes their ID, name and current state,\n    e.g. created or completed\n    ",
+        "description": "\nList the tasks in a project. Uses your default project unless --project\nis given. By default, this includes their ID, name and current state,\ne.g. created or completed\n",
         "allow_extra": false,
         "parent": "tasks",
         "is_placeholder": false
@@ -8071,7 +8071,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Fetch a batch of questions from a running annotation task.\n\n    Mirrors the web app: asks the broker for a Prodigy login token, then talks\n    to the task pod directly via its public task_url. Note that requesting a\n    batch reserves those questions for this CLI's session \u2014 they will not be\n    handed to other annotators until they are answered or another session\n    runs out of work and steals them.\n    ",
+        "description": "Fetch a batch of questions from a running annotation task.\n\nMirrors the web app: asks the broker for a Prodigy login token, then talks\nto the task pod directly via its public task_url. Note that requesting a\nbatch reserves those questions for this CLI's session \u2014 they will not be\nhanded to other annotators until they are answered or another session\nruns out of work and steals them.\n",
         "allow_extra": false,
         "parent": "tasks",
         "is_placeholder": false
@@ -8628,7 +8628,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Update a user's role, name, locale, or tags.\n\n    Email can't be set here: it's the login identity, so it can only be\n    changed through the verified change-email flow (a confirmation link\n    sent to the new address) \u2014 see ellf_pam/api/user.py.\n    ",
+        "description": "Update a user's role, name, locale, or tags.\n\nEmail can't be set here: it's the login identity, so it can only be\nchanged through the verified change-email flow (a confirmation link\nsent to the new address) \u2014 see ellf_pam/api/user.py.\n",
         "allow_extra": false,
         "parent": "users",
         "is_placeholder": false
@@ -8676,7 +8676,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Remove a user from the organization. By default the user is\n    deactivated: they lose access and stop taking up a seat, but their\n    work stays in the organization and an admin can reactivate them.",
+        "description": "Remove a user from the organization. By default the user is\ndeactivated: they lose access and stop taking up a seat, but their\nwork stays in the organization and an admin can reactivate them.",
         "allow_extra": false,
         "parent": "users",
         "is_placeholder": false
@@ -8711,7 +8711,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "Reactivate a user who was removed from the organization. They get\n    back the access they had, and take up a seat again.",
+        "description": "Reactivate a user who was removed from the organization. They get\nback the access they had, and take up a seat again.",
         "allow_extra": false,
         "parent": "users",
         "is_placeholder": false
@@ -8959,7 +8959,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "\n    Assign an annotator to a task and email them an invitation to start\n    annotating.\n    ",
+        "description": "\nAssign an annotator to a task and email them an invitation to start\nannotating.\n",
         "allow_extra": false,
         "parent": "users",
         "is_placeholder": false
@@ -9033,7 +9033,7 @@
             "orig_type": "bool"
           }
         ],
-        "description": "\n    Remove an annotator from a task. This only removes the assignment and\n    keeps all annotations the user has created.\n    ",
+        "description": "\nRemove an annotator from a task. This only removes the assignment and\nkeeps all annotations the user has created.\n",
         "allow_extra": false,
         "parent": "users",
         "is_placeholder": false

{ellf_cli-18.0.40 → ellf_cli-18.0.41}/ellf_cli/helm.py

@@ -208,6 +208,13 @@ class HelmChartValues(_StrictModel):
     class ServiceAccount(_StrictModel):
         annotations: dict[str, str]
 
+    class CloudStorage(_StrictModel):
+        url: str
+        account_url: Annotated[str, Field(alias="accountUrl")]
+        azure_workload_identity_client_id: Annotated[
+            str, Field(alias="azureWorkloadIdentityClientId")
+        ]
+
     class Broker(_StrictModel):
         class BrokerProbe(_StrictModel):
             initial_delay_seconds: Annotated[int, Field(alias="initialDelaySeconds")]
@@ -371,6 +378,7 @@ class HelmChartValues(_StrictModel):
     default_worker_type: Annotated[str, Field(alias="defaultWorkerType")]
     prodigy_pypi_index_url: Annotated[str, Field(alias="prodigyPypiIndexUrl")]
     cost_view_table: Annotated[str, Field(alias="costViewTable")]
+    cloud_storage: Annotated[CloudStorage, Field(alias="cloudStorage")]
     registries: Registries
     image: Image
     broker: Broker
@@ -431,6 +439,13 @@ class HelmChartOverrides(_StrictModel):
     class ServiceAccount(_StrictModel):
         annotations: dict[str, str] | None = None
 
+    class CloudStorage(_StrictModel):
+        url: str | None = None
+        account_url: Annotated[str | None, Field(alias="accountUrl")] = None
+        azure_workload_identity_client_id: Annotated[
+            str | None, Field(alias="azureWorkloadIdentityClientId")
+        ] = None
+
     class Broker(_StrictModel):
         class BrokerProbe(_StrictModel):
             initial_delay_seconds: Annotated[
@@ -620,6 +635,7 @@ class HelmChartOverrides(_StrictModel):
         str | None, Field(alias="prodigyPypiIndexUrl")
     ] = None
     cost_view_table: Annotated[str | None, Field(alias="costViewTable")] = None
+    cloud_storage: Annotated[CloudStorage | None, Field(alias="cloudStorage")] = None
     registries: Registries | None = None
     image: Image | None = None
     broker: Broker | None = None
@@ -882,6 +898,15 @@ def build_values(
         default_worker_type=config.default_worker_type or None,
         prodigy_pypi_index_url=config.deployment.prodigy_pypi_index_url or None,
         cost_view_table=config.deployment.cost_view_table or None,
+        cloud_storage=HelmChartOverrides.CloudStorage(
+            url=config.deployment.cloud_storage_url,
+            account_url=config.deployment.cloud_storage_account_url or None,
+            azure_workload_identity_client_id=(
+                config.deployment.workload_identity_client_id or None
+            ),
+        )
+        if config.deployment.cloud_storage_url
+        else None,
         secrets=HelmChartOverrides.Secrets(
             container_sa_key=creds.secrets.container_sa_key,
             prodigy_license_key=creds.secrets.prodigy_license_key,

ellf_cli-18.0.41/ellf_cli/version/18.0.40_2026-09-24-19-58-14_patch_ff18824b-be51-4a3d-a621-e96279e53c3e

@@ -0,0 +1,3 @@
+18.0.40
+patch
+ff18824b-be51-4a3d-a621-e96279e53c3e

{ellf_cli-18.0.40 → ellf_cli-18.0.41/ellf_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ellf-cli
-Version: 18.0.40
+Version: 18.0.41
 Summary: Ellf Command Line Interface
 Home-page: https://prodi.gy
 Author: ExplosionAI GmbH

{ellf_cli-18.0.40 → ellf_cli-18.0.41}/ellf_cli.egg-info/SOURCES.txt

@@ -295,6 +295,7 @@ ellf_cli/version/18.0.37_2026-09-23-13-08-30_patch_8e4b1d24-156e-4ffe-8e4a-b8740
 ellf_cli/version/18.0.38_2026-09-24-06-41-37_patch_67adb1d6-3f49-4357-a67f-b1d48f23a972
 ellf_cli/version/18.0.39_2026-09-24-15-24-32_patch_e5dd375d-5643-4514-9b65-8d877c4a2bb2
 ellf_cli/version/18.0.3_2026-09-13-12-32-46_patch_58e5ce3a-f2a7-4789-b2cd-5cc75c72b6ec
+ellf_cli/version/18.0.40_2026-09-24-19-58-14_patch_ff18824b-be51-4a3d-a621-e96279e53c3e
 ellf_cli/version/18.0.4_2026-09-13-12-45-14_patch_b6c79d55-8f85-4f47-a304-df52b122c38c
 ellf_cli/version/18.0.5_2026-09-13-14-11-18_patch_9b111116-5e62-472a-b72c-d1bbafa22c97
 ellf_cli/version/18.0.5_2026-09-13-17-01-11_patch_d4bf61c0-83ac-4dd3-b512-a65805d298c8