ellf-cli 22.0.2__tar.gz → 22.0.3__tar.gz

{ellf_cli-22.0.2/ellf_cli.egg-info → ellf_cli-22.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ellf-cli
-Version: 22.0.2
+Version: 22.0.3
 Summary: Ellf Command Line Interface
 Home-page: https://prodi.gy
 Author: ExplosionAI GmbH

{ellf_cli-22.0.2 → ellf_cli-22.0.3}/README.md

@@ -664,7 +664,7 @@ Register a new cluster with PAM and write credentials to cluster-creds.json. Pas
 | Argument | Type | Description | Default |
 | --- | --- | --- | --- |
 | `--name` | `str` | Human-readable name for the cluster |  |
-| `--domain` | `str` | Public address the cluster is reached on, host or host:port (e.g. 'cluster.example.com' for a hosted cluster on port 443, or 'http://localhost' for a cluster on this machine, which needs no certificate and is what the free Solo plan uses). Stored verbatim as the cluster address; the chart derives the bare hostname for K8s ingress / cert SAN where a port isn't allowed. Omit to get a managed subdomain under an Explosion-controlled zone. | `None` |
+| `--domain` | `str` | Public address the cluster is reached on, host or host:port (e.g. 'cluster.example.com' for a hosted cluster on port 443, or 'http://localhost' for a cluster on this machine, which needs no certificate and is what the free Solo plan uses by default; Safari can't reach it there, so for Safari use 'https://localhost[:port]', see 'ellf infra tls'). Stored verbatim as the cluster address; the chart derives the bare hostname for K8s ingress / cert SAN where a port isn't allowed. Omit to get a managed subdomain under an Explosion-controlled zone. | `None` |
 | `--subdomain` | `str` | Requested label for a managed subdomain (e.g. 'acme' for acme.<zone>). Only valid without --domain; defaults to a slug derived from your org/cluster name. | `None` |
 | `--public-ip` | `str` | Cluster ingress IP to point the managed subdomain at. Omit to reserve the name now and re-run with --public-ip once the load balancer IP is known. | `None` |
 | `--cloud-provider` | `str` | Cloud provider: gcp, k3s, aws, azure |  |
@@ -720,6 +720,18 @@ Destroy the cluster infrastructure created by 'infra terraform', including every
 | `--delete-data` | `bool` | Required: confirms deleting the cluster's database, data bucket and shared volume along with the cluster | `False` |
 | `--tf-auto-accept` | `bool` | Accept the destroy plan without interaction | `False` |
 
+#### `ellf infra tls`
+
+Serve a cluster on this machine at https://localhost. Only Safari needs this: it blocks Ellf from calling a cluster at http://localhost, which every other browser allows. Register and deploy the cluster at https://localhost (or https://localhost:<port>) and 'infra deploy' issues its certificate from a CA the CLI keeps, which can only sign for localhost. Then trust that CA once with --trust. Run on the machine the cluster runs on, with kubectl pointed at it.
+
+| Argument | Type | Description | Default |
+| --- | --- | --- | --- |
+| `--self-signed` | `bool` | Issue the cluster a certificate from the localhost-only CA | `False` |
+| `--trust` | `bool` | Print the commands to trust the localhost-only CA | `False` |
+| `--status` | `bool` | Show the cluster's TLS setup | `False` |
+| `--namespace` | `str` | Kubernetes namespace | `'ellf'` |
+| `--output` | `str` | Output format for trust commands: human, json, shell | `'human'` |
+
 #### `ellf infra init`
 
 Initialize a cluster: register with PAM (allocating a managed domain unless --domain is given), download the terraform files, and generate config.yaml — the input every later phase (configure, provision, start) reads. Idempotent and safe to re-run. After init, the directory is a complete hand-off bundle (terraform files + terraform.tfvars.json + config.yaml) for teams that apply terraform through their own pipeline; they later sync outputs back with 'ellf infra configure --from-terraform' instead of 'ellf infra provision'.
@@ -838,7 +850,7 @@ Generate a values.yaml for Helm deployment from credentials and provider default
 | --- | --- | --- | --- |
 | `--creds` | `Path` | Path to cluster-creds.json from 'infra register' |  |
 | `--cloud-provider` | `str` | Cloud provider: gcp, k3s, aws, azure |  |
-| `--domain` | `str` | Public address the cluster is reached on, host or host:port (e.g. 'cluster.example.com' or 'localhost:8443'). Prefix with 'http://' for plain-HTTP local clusters (e.g. loopback k3s) to skip TLS entirely. Match what was passed to 'infra register' — it flows into ELLF_BROKER_HOST so the cluster emits matching OIDC / token URLs. |  |
+| `--domain` | `str` | Public address the cluster is reached on, host or host:port (e.g. 'cluster.example.com'). Use 'http://localhost' for a cluster on this machine, which needs no certificate and works in every browser but Safari; 'https://localhost[:port]' serves it with a certificate from a localhost-only CA the CLI keeps, for Safari (see 'ellf infra tls'). Match what was passed to 'infra register' — it flows into ELLF_BROKER_HOST so the cluster emits matching OIDC / token URLs. |  |
 | `--out` | `Path` | Output path for generated values.yaml | `'values.yaml'` |
 | `--acme-email` | `str` | Email for Let's Encrypt certificates | `None` |
 

{ellf_cli-22.0.2 → ellf_cli-22.0.3}/ellf_cli/__main__.py

@@ -7,9 +7,9 @@ import truststore
 # Use the OS native trust store (macOS Keychain, /etc/ssl/certs on Linux,
 # Windows certificate store) for every httpx/urllib/requests call this
 # CLI makes — instead of httpx's default certifi bundle — so a CA the
-# machine already trusts (a corporate proxy's, or a dev stack's) is
-# trusted by the browser, curl and the CLI alike, with no SSL_CERT_FILE
-# or separate bundle to maintain.
+# machine already trusts (a corporate proxy's, a dev stack's, or the
+# localhost CA from `ellf infra tls`) is trusted by the browser, curl and
+# the CLI alike, with no SSL_CERT_FILE or separate bundle to maintain.
 # Must run before any code constructs an ssl.SSLContext, so it sits at
 # module top.
 truststore.inject_into_ssl()

{ellf_cli-22.0.2 → ellf_cli-22.0.3}/ellf_cli/commands/infra/__init__.py

@@ -10,4 +10,5 @@ from . import (  # noqa: F401
     setup,
     start,
     terraform,
+    tls,
 )

{ellf_cli-22.0.2 → ellf_cli-22.0.3}/ellf_cli/commands/infra/deploy.py

@@ -28,6 +28,12 @@ from ...url import URL
 from .._state import get_auth_state
 from ._config_io import FILL_IN
 from ._helpers import create_image_pull_secret, ensure_traefik, helm_registry_login
+from .tls import (
+    LocalTlsError,
+    ensure_cluster_certificate,
+    manages_local_tls,
+    report_trust,
+)
 
 DEFAULT_NAMESPACE = "ellf"
 DEFAULT_RELEASE = "ellf"
@@ -190,7 +196,16 @@ def deploy(
     # 5. Without an ingress controller nothing serves the cluster's domain.
     # k3s bundles Traefik, but Colima (and k3s --disable traefik) turn it off.
     _ensure_ingress_controller(overrides)
-    # 6. Helm upgrade --install
+    # 6. A cluster at https://localhost is served a certificate from the CLI's
+    # localhost-only CA, issued (or renewed) before the chart points at it.
+    local_tls_cert = None
+    if manages_local_tls(overrides):
+        try:
+            local_tls_cert = ensure_cluster_certificate(namespace)
+        except LocalTlsError as e:
+            msg.fail(str(e))
+            raise SystemExit(1)
+    # 7. Helm upgrade --install
     if chart is None:
         # Use OCI chart from the registry
         if not registry:
@@ -206,7 +221,7 @@ def deploy(
     else:
         msg.info(f"Installing from local chart {chart}...")
         upgrade(chart, overrides, namespace=namespace, wait=wait)
-    # 7. Every worker type pins jobs to nodes labeled ellf/node-class=<node_class>.
+    # 8. Every worker type pins jobs to nodes labeled ellf/node-class=<node_class>.
     # Cloud node pools get that label from terraform; a hand-built cluster (k3s
     # on a workstation) doesn't, and every job then sits Pending with "didn't
     # match Pod's node affinity/selector". Read the types the chart actually
@@ -214,6 +229,8 @@ def deploy(
     # default) and label the sole node on single-node clusters.
     _ensure_worker_type_labels(namespace)
     msg.good("Deployment complete")
+    if local_tls_cert is not None:
+        report_trust(local_tls_cert)
     if wait:
         msg.info("Running verification checks...")
         preflight_test(release=DEFAULT_RELEASE, namespace=namespace)

{ellf_cli-22.0.2 → ellf_cli-22.0.3}/ellf_cli/commands/infra/init.py

@@ -24,6 +24,7 @@ from .terraform import (
     ensure_ingress_ip,
     record_backend,
 )
+from .tls import is_local_https
 
 # Per-provider defaults mirroring infra/cluster/config-*-example.yaml.
 _SYSTEM_POOL_MACHINE = {
@@ -169,9 +170,12 @@ def init(
         # Stage 1 covers the cloud path; the k3s deployment isn't
         # representable in ClusterConfig yet, so hand over to the documented
         # local flow after registration.
-        # A cluster on http://localhost needs no certificate; one on a
+        # A cluster on http://localhost needs no certificate. One at
+        # https://localhost (for Safari) gets one from the CLI's localhost
+        # CA at deploy time, which this machine then has to trust. One on a
         # public domain gets Let's Encrypt through cert-manager.
-        if address.startswith("http://"):
+        local_https = is_local_https(address)
+        if address.startswith("http://") or local_https:
             steps = [
                 "ellf infra init-values --creds cluster-creds.json "
                 f"--cloud-provider k3s --domain {address}",
@@ -183,6 +187,8 @@ def init(
                 f"--cloud-provider k3s --domain {address} --acme-email <email>",
             ]
         steps.append("ellf infra deploy --values values.yaml --wait")
+        if local_https:
+            steps.append("ellf infra tls --trust")
         msg.info("Local (k3s) cluster registered. Continue with the local flow:")
         # Plain prints: wasabi re-wraps its messages, which ran the steps
         # together into one paragraph.

{ellf_cli-22.0.2 → ellf_cli-22.0.3}/ellf_cli/commands/infra/init_values.py

@@ -12,6 +12,7 @@ from ...cli import cli
 from ...helm import IMAGE_PULL_SECRET_NAME
 from ...url import URL
 from ._helpers import ClusterCredsFile
+from .tls import LOCAL_TLS_SECRET_NAME, is_local_https
 
 CLOUD_PROVIDERS = ("gcp", "k3s", "aws", "azure")
 
@@ -28,9 +29,11 @@ CLOUD_PROVIDERS = ("gcp", "k3s", "aws", "azure")
         "--domain",
         help=(
             "Public address the cluster is reached on, host or host:port "
-            "(e.g. 'cluster.example.com' or 'localhost:8443'). Prefix with "
-            "'http://' for plain-HTTP local clusters (e.g. loopback k3s) to "
-            "skip TLS entirely. Match what was passed to 'infra register' — "
+            "(e.g. 'cluster.example.com'). Use 'http://localhost' for a cluster "
+            "on this machine, which needs no certificate and works in every "
+            "browser but Safari; 'https://localhost[:port]' serves it with a "
+            "certificate from a localhost-only CA the CLI keeps, for Safari "
+            "(see 'ellf infra tls'). Match what was passed to 'infra register' — "
             "it flows into ELLF_BROKER_HOST so the cluster emits matching "
             "OIDC / token URLs."
         ),
@@ -95,6 +98,10 @@ def init_values(
     if acme_email:
         values["ingress"] = {"tls": {"secretName": "ellf-tls"}}
         values["certManager"] = {"acmeEmail": acme_email}
+    elif is_local_https(domain):
+        # Let's Encrypt can't issue for localhost: 'infra deploy' issues the
+        # certificate from the CLI's localhost-only CA instead.
+        values["ingress"] = {"tls": {"secretName": LOCAL_TLS_SECRET_NAME}}
     if cloud_provider == "k3s":
         # State the selector explicitly rather than relying on the chart
         # default — deploy-time node labeling reads this file, not the chart.

{ellf_cli-22.0.2 → ellf_cli-22.0.3}/ellf_cli/commands/infra/register.py

@@ -50,7 +50,9 @@ class Registration(NamedTuple):
             "Public address the cluster is reached on, host or host:port "
             "(e.g. 'cluster.example.com' for a hosted cluster on port 443, "
             "or 'http://localhost' for a cluster on this machine, which needs "
-            "no certificate and is what the free Solo plan uses). "
+            "no certificate and is what the free Solo plan uses by default; "
+            "Safari can't reach it there, so for Safari use "
+            "'https://localhost[:port]', see 'ellf infra tls'). "
             "Stored verbatim as the cluster address; the chart derives the "
             "bare hostname for K8s ingress / cert SAN where a port isn't allowed. "
             "Omit to get a managed subdomain under an Explosion-controlled zone."
@@ -186,8 +188,9 @@ def ensure_registered(
     # Solo's one cluster is on localhost, and PAM refuses it anything else.
     if domain is None and _org_is_solo(client, org_id):
         msg.info(Messages.T074)
-        # Plain http: browsers treat localhost as a secure context, so
-        # the cluster needs no certificate.
+        # Plain http needs no certificate, and every browser but Safari lets
+        # an https page call http://localhost. Safari users opt into
+        # https://localhost with 'ellf infra tls'.
         domain = "http://localhost"
     # With no --domain, register under a placeholder first; the managed
     # subdomain allocation below replaces it with the real FQDN. On