ellf-cli 21.0.0__tar.gz → 21.0.1__tar.gz

{ellf_cli-21.0.0/ellf_cli.egg-info → ellf_cli-21.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ellf-cli
-Version: 21.0.0
+Version: 21.0.1
 Summary: Ellf Command Line Interface
 Home-page: https://prodi.gy
 Author: ExplosionAI GmbH

{ellf_cli-21.0.0 → ellf_cli-21.0.1}/ellf_cli/commands/infra/_helpers.py

@@ -214,7 +214,41 @@ def k3s_traefik_exists() -> bool:
     return result.returncode == 0
 
 
-def ensure_traefik(public_ip: str = "") -> None:
+def traefik_values(
+    public_ip: str = "", port: int | None = None, tls: bool = False
+) -> dict:
+    """Helm values for the Traefik install. *port* adds an entrypoint for a
+    cluster reached on a port other than 80/443 (e.g. localhost:8443 on
+    Colima, which forwards each port the VM listens on to the same port on
+    the Mac)."""
+    ports: dict = {"web": {"port": 80}, "websecure": {"port": 443}}
+    if port is not None and port not in (80, 443):
+        ports["ellf"] = {
+            "port": port,
+            "exposedPort": port,
+            "expose": {"default": True},
+            "protocol": "TCP",
+            "tls": {"enabled": tls},
+        }
+    values: dict = {
+        "providers": {
+            "kubernetesIngress": {"enabled": True},
+        },
+        "ingressRoute": {"dashboard": {"enabled": False}},
+        "ports": ports,
+        "securityContext": {
+            "capabilities": {"drop": [], "add": ["NET_BIND_SERVICE"]},
+        },
+        "tolerations": SYSTEM_NODE_TOLERATIONS,
+    }
+    if public_ip:
+        values["service"] = {"spec": {"loadBalancerIP": public_ip}}
+    return values
+
+
+def ensure_traefik(
+    public_ip: str = "", port: int | None = None, tls: bool = False
+) -> None:
     """Install or upgrade Traefik via Helm."""
     if k3s_traefik_exists():
         msg.info(
@@ -233,19 +267,7 @@ def ensure_traefik(public_ip: str = "") -> None:
         capture_output=True,
         text=True,
     )
-    values: dict = {
-        "providers": {
-            "kubernetesIngress": {"enabled": True},
-        },
-        "ingressRoute": {"dashboard": {"enabled": False}},
-        "ports": {"web": {"port": 80}, "websecure": {"port": 443}},
-        "securityContext": {
-            "capabilities": {"drop": [], "add": ["NET_BIND_SERVICE"]},
-        },
-        "tolerations": SYSTEM_NODE_TOLERATIONS,
-    }
-    if public_ip:
-        values["service"] = {"spec": {"loadBalancerIP": public_ip}}
+    values = traefik_values(public_ip, port, tls)
     with tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=False) as tmp:
         tmp.write(json.dumps(values))
         tmp_path = tmp.name

{ellf_cli-21.0.0 → ellf_cli-21.0.1}/ellf_cli/commands/infra/deploy.py

@@ -24,11 +24,14 @@ from ...helm import (
     user_registry_of,
 )
 from ...key_pair import generate_key_pair
+from ...url import URL
 from .._state import get_auth_state
-from ._helpers import create_image_pull_secret, helm_registry_login
+from ._config_io import FILL_IN
+from ._helpers import create_image_pull_secret, ensure_traefik, helm_registry_login
 
 DEFAULT_NAMESPACE = "ellf"
 DEFAULT_RELEASE = "ellf"
+DEFAULT_INGRESS_CLASS = "traefik"
 
 
 @cli.subcommand(
@@ -62,6 +65,18 @@ def deploy(
     # key, wrong type, missing required field) fails right here, before any of
     # the side effects below touch the cluster or PAM.
     overrides = HelmChartOverrides(**values_dict)
+    placeholders = _placeholder_keys(values_dict)
+    if placeholders:
+        msg.fail(
+            f"{values_file} still has FILL-IN placeholders: {', '.join(placeholders)}"
+        )
+        if "registries.user" in placeholders:
+            msg.text(
+                "registries.user is a registry this cluster can push custom "
+                "recipe images to. On a single-node cluster, delete it and set "
+                "localRegistry.enabled: true to use the chart's own registry."
+            )
+        raise SystemExit(1)
     # Image versions are dynamic state owned by PAM's cluster settings.
     # They are injected into the helm invocation here and deliberately
     # never written back to values.yaml.
@@ -166,7 +181,10 @@ def deploy(
                 )
             )
             msg.good("Registered cluster public key with PAM")
-    # 5. Helm upgrade --install
+    # 5. Without an ingress controller nothing serves the cluster's domain.
+    # k3s bundles Traefik, but Colima (and k3s --disable traefik) turn it off.
+    _ensure_ingress_controller(overrides)
+    # 6. Helm upgrade --install
     if chart is None:
         # Use OCI chart from the registry
         if not registry:
@@ -182,7 +200,7 @@ def deploy(
     else:
         msg.info(f"Installing from local chart {chart}...")
         upgrade(chart, overrides, namespace=namespace, wait=wait)
-    # 6. Every worker type pins jobs to nodes labeled ellf/node-class=<node_class>.
+    # 7. Every worker type pins jobs to nodes labeled ellf/node-class=<node_class>.
     # Cloud node pools get that label from terraform; a hand-built cluster (k3s
     # on a workstation) doesn't, and every job then sits Pending with "didn't
     # match Pod's node affinity/selector". Read the types the chart actually
@@ -195,6 +213,55 @@ def deploy(
         preflight_test(release=DEFAULT_RELEASE, namespace=namespace)
 
 
+def _placeholder_keys(values: object, prefix: str = "") -> list[str]:
+    """Dotted paths of the values ``infra init-values`` left as FILL-IN."""
+    if isinstance(values, dict):
+        return [
+            key
+            for name, value in values.items()
+            for key in _placeholder_keys(value, f"{prefix}{name}.")
+        ]
+    if isinstance(values, list):
+        return [
+            key
+            for i, value in enumerate(values)
+            for key in _placeholder_keys(value, f"{prefix}{i}.")
+        ]
+    if isinstance(values, str) and FILL_IN in values:
+        return [prefix.rstrip(".")]
+    return []
+
+
+def _ensure_ingress_controller(overrides: HelmChartOverrides) -> None:
+    """Install Traefik when the chart's IngressClass doesn't exist yet,
+    listening on the cluster domain's port as well as 80/443."""
+    class_name = (
+        overrides.ingress.class_name if overrides.ingress else None
+    ) or DEFAULT_INGRESS_CLASS
+    found = subprocess.run(
+        ["kubectl", "get", "ingressclass", class_name, "-o", "name"],
+        capture_output=True,
+        text=True,
+    )
+    if found.returncode == 0 and found.stdout.strip():
+        return
+    if class_name != DEFAULT_INGRESS_CLASS:
+        msg.warn(
+            f"IngressClass '{class_name}' doesn't exist. Install its ingress "
+            "controller, or nothing will serve the cluster's domain."
+        )
+        return
+    cluster = overrides.cluster
+    port = None
+    tls = False
+    if cluster and cluster.fqdn:
+        domain = URL.parse(f"{cluster.scheme or 'https'}://{cluster.fqdn}")
+        port = domain.port
+        tls = domain.scheme == "https"
+    msg.info("No Traefik IngressClass found; installing Traefik")
+    ensure_traefik(port=port, tls=tls)
+
+
 def _ensure_cluster_keypair_standalone(
     secret_name: str, namespace: str, database_password: str = ""
 ) -> str:

{ellf_cli-21.0.0 → ellf_cli-21.0.1}/ellf_cli/ellf.json

@@ -1,7 +1,7 @@
 {
   "prog": "ellf",
   "help": "Ellf Command Line Interface.",
-  "version": "21.0.0",
+  "version": "21.0.1",
   "extra_key": "_extra",
   "commands": {
     "actions": {

ellf_cli-21.0.1/ellf_cli/version/21.0.0_2026-10-16-10-44-29_patch_1058e453-613f-492b-a3c7-f3ca2abe8c2d

@@ -0,0 +1,3 @@
+21.0.0
+patch
+1058e453-613f-492b-a3c7-f3ca2abe8c2d

{ellf_cli-21.0.0 → ellf_cli-21.0.1/ellf_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ellf-cli
-Version: 21.0.0
+Version: 21.0.1
 Summary: Ellf Command Line Interface
 Home-page: https://prodi.gy
 Author: ExplosionAI GmbH

{ellf_cli-21.0.0 → ellf_cli-21.0.1}/ellf_cli.egg-info/SOURCES.txt

@@ -337,6 +337,7 @@ ellf_cli/version/20.0.4_2026-10-14-16-20-24_patch_c6672844-8227-4e0a-9fb5-36af7e
 ellf_cli/version/20.0.5_2026-10-15-08-53-28_patch_10154146-8afd-4632-b250-9b4b9f5bf67c
 ellf_cli/version/20.0.6_2026-10-15-14-17-40_patch_df3a5d3c-f0e0-46cb-aeaf-15b51c8a0f13
 ellf_cli/version/20.0.7_2026-10-16-07-09-40_major_3e5dfba3-2810-47b4-85a9-938bfff72a04
+ellf_cli/version/21.0.0_2026-10-16-10-44-29_patch_1058e453-613f-492b-a3c7-f3ca2abe8c2d
 ellf_cli/version/__init__.py
 ellf_cli/version/read_version.py
 tests/test_agents.py
@@ -355,6 +356,7 @@ tests/test_info.py
 tests/test_infra_config_io.py
 tests/test_infra_configure.py
 tests/test_infra_deploy_node_labels.py
+tests/test_infra_deploy_preflight.py
 tests/test_infra_destroy.py
 tests/test_infra_get_terraform.py
 tests/test_infra_hibernate.py

ellf_cli-21.0.1/tests/test_infra_deploy_preflight.py

@@ -0,0 +1,75 @@
+"""What `ellf infra deploy` checks and installs before the chart: no FILL-IN
+placeholders left in values.yaml, and an ingress controller serving the
+cluster's domain (Colima's k3s ships without Traefik)."""
+
+from subprocess import CompletedProcess
+from unittest.mock import patch
+
+from ellf_cli.commands.infra._helpers import traefik_values
+from ellf_cli.commands.infra.deploy import (
+    _ensure_ingress_controller,
+    _placeholder_keys,
+)
+from ellf_cli.helm import HelmChartOverrides
+
+
+def test_placeholder_keys_are_found_at_any_depth():
+    values = {
+        "registries": {"upstream": "r", "user": "FILL-IN-from-terraform-output"},
+        "database": {"ip": "FILL-IN", "user": "cluster_user"},
+        "imagePullSecrets": [{"name": "FILL-IN"}],
+        "networkPolicy": True,
+        "storage": {"hostPath": ""},
+    }
+    assert _placeholder_keys(values) == [
+        "registries.user",
+        "database.ip",
+        "imagePullSecrets.0.name",
+    ]
+
+
+def test_no_extra_entrypoint_on_standard_ports():
+    for port in (None, 80, 443):
+        assert set(traefik_values(port=port)["ports"]) == {"web", "websecure"}
+
+
+def test_entrypoint_on_the_domain_port():
+    ellf = traefik_values(port=8443)["ports"]["ellf"]
+    assert ellf["port"] == ellf["exposedPort"] == 8443
+    assert ellf["tls"] == {"enabled": False}
+    assert traefik_values(port=8443, tls=True)["ports"]["ellf"]["tls"] == {
+        "enabled": True
+    }
+
+
+def _overrides(fqdn: str, scheme: str) -> HelmChartOverrides:
+    return HelmChartOverrides.model_validate(
+        {"cluster": {"fqdn": fqdn, "scheme": scheme}}
+    )
+
+
+def _kubectl(stdout: str):
+    def run(cmd, **kwargs):
+        assert cmd[:3] == ["kubectl", "get", "ingressclass"]
+        return CompletedProcess(cmd, 0 if stdout else 1, stdout=stdout, stderr="")
+
+    return run
+
+
+def test_traefik_is_installed_when_the_cluster_has_none():
+    with (
+        patch("ellf_cli.commands.infra.deploy.subprocess.run", _kubectl("")),
+        patch("ellf_cli.commands.infra.deploy.ensure_traefik") as ensure,
+    ):
+        _ensure_ingress_controller(_overrides("localhost:8443", "http"))
+    ensure.assert_called_once_with(port=8443, tls=False)
+
+
+def test_an_existing_ingress_class_is_left_alone():
+    found = _kubectl("ingressclass.networking.k8s.io/traefik")
+    with (
+        patch("ellf_cli.commands.infra.deploy.subprocess.run", found),
+        patch("ellf_cli.commands.infra.deploy.ensure_traefik") as ensure,
+    ):
+        _ensure_ingress_controller(_overrides("localhost:8443", "http"))
+    ensure.assert_not_called()