ellf-cli 22.0.2__tar.gz → 22.0.4__tar.gz

{ellf_cli-22.0.2/ellf_cli.egg-info → ellf_cli-22.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ellf-cli
-Version: 22.0.2
+Version: 22.0.4
 Summary: Ellf Command Line Interface
 Home-page: https://prodi.gy
 Author: ExplosionAI GmbH

{ellf_cli-22.0.2 → ellf_cli-22.0.4}/README.md

@@ -358,7 +358,7 @@ Get detailed info for a cluster
 | Argument | Type | Description | Default |
 | --- | --- | --- | --- |
 | `name_or_id` | `Union[str, UUID]` | Name or ID of the cluster |  |
-| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'org_id', 'name', 'address', 'state', 'cloud_provider', 'cloud', 'managed_subdomain', 'gcp_project', 'is_hosted'] | `None` |
+| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'org_id', 'name', 'address', 'state', 'cloud_provider', 'cloud', 'managed_subdomain', 'gcp_project', 'is_hosted', 'ca_certificate'] | `None` |
 | `--json` | `bool` | Output the result as JSON | `False` |
 
 #### `ellf clusters update`
@@ -659,14 +659,14 @@ Deploy and manage cluster infrastructure (Kubernetes, TLS, Terraform)
 
 #### `ellf infra register`
 
-Register a new cluster with PAM and write credentials to cluster-creds.json. Pass --domain to use your own DNS, or omit it to be allocated a managed subdomain (with base + wildcard A records) under an Explosion-controlled zone. An org on the free Solo plan has no managed subdomain: omitting --domain registers it at http://localhost.
+Register a new cluster with PAM and write credentials to cluster-creds.json. Pass --domain to use your own DNS, or omit it to be allocated a managed subdomain (with an A record) under an Explosion-controlled zone. An org on the free Solo plan has no managed subdomain: omitting --domain registers it at http://localhost.
 
 | Argument | Type | Description | Default |
 | --- | --- | --- | --- |
 | `--name` | `str` | Human-readable name for the cluster |  |
-| `--domain` | `str` | Public address the cluster is reached on, host or host:port (e.g. 'cluster.example.com' for a hosted cluster on port 443, or 'http://localhost' for a cluster on this machine, which needs no certificate and is what the free Solo plan uses). Stored verbatim as the cluster address; the chart derives the bare hostname for K8s ingress / cert SAN where a port isn't allowed. Omit to get a managed subdomain under an Explosion-controlled zone. | `None` |
+| `--domain` | `str` | Public address the cluster is reached on, host or host:port (e.g. 'cluster.example.com' for a hosted cluster on port 443, or 'http://localhost' for a cluster on this machine, which needs no certificate and is what the free Solo plan uses by default; Safari can't reach it there, so for Safari use 'https://localhost[:port]', and to reach it from other devices 'https://<its IP address on your network>'; Ellf issues those a certificate, see 'ellf infra tls'). Stored verbatim as the cluster address; the chart derives the bare hostname for K8s ingress / cert SAN where a port isn't allowed. Omit to get a managed subdomain under an Explosion-controlled zone. | `None` |
 | `--subdomain` | `str` | Requested label for a managed subdomain (e.g. 'acme' for acme.<zone>). Only valid without --domain; defaults to a slug derived from your org/cluster name. | `None` |
-| `--public-ip` | `str` | Cluster ingress IP to point the managed subdomain at. Omit to reserve the name now and re-run with --public-ip once the load balancer IP is known. | `None` |
+| `--public-ip` | `str` | Cluster ingress IP to point the managed subdomain at: a public IPv4 address. Omit to reserve the name now and re-run with --public-ip once the load balancer IP is known. A cluster on a private network uses --domain with your own DNS instead. | `None` |
 | `--cloud-provider` | `str` | Cloud provider: gcp, k3s, aws, azure |  |
 | `--gcp-project` | `str` | GCP project the cluster is billed under. Recorded on the cluster record as the precondition for cloud-cost collection (see docs/drafts/cloud-costs.md). Re-running register updates it. | `None` |
 | `--hosted` | `bool` | Mark the cluster as Explosion-hosted. Hosted clusters get their metered cloud costs charged back with a margin — Explosion-operators only, not for BYO clusters. | `False` |
@@ -720,6 +720,17 @@ Destroy the cluster infrastructure created by 'infra terraform', including every
 | `--delete-data` | `bool` | Required: confirms deleting the cluster's database, data bucket and shared volume along with the cluster | `False` |
 | `--tf-auto-accept` | `bool` | Accept the destroy plan without interaction | `False` |
 
+#### `ellf infra tls`
+
+Trust the certificate Ellf issues a cluster on localhost or a private network. Such a cluster is served over https with a certificate from a CA Ellf keeps for it, which can only certify the cluster's own address. Run this with --trust on each device you open Ellf on, once. It needs only your Ellf login, not kubectl.
+
+| Argument | Type | Description | Default |
+| --- | --- | --- | --- |
+| `--trust` | `bool` | Fetch the cluster's certificate authority from Ellf and print the commands to trust it on this device | `False` |
+| `--status` | `bool` | Show the certificate authority Ellf keeps for the cluster | `False` |
+| `--cluster` | `str` | Name or ID of the cluster (default: the current one) | `None` |
+| `--output` | `str` | Output format for trust commands: human, json, shell | `'human'` |
+
 #### `ellf infra init`
 
 Initialize a cluster: register with PAM (allocating a managed domain unless --domain is given), download the terraform files, and generate config.yaml — the input every later phase (configure, provision, start) reads. Idempotent and safe to re-run. After init, the directory is a complete hand-off bundle (terraform files + terraform.tfvars.json + config.yaml) for teams that apply terraform through their own pipeline; they later sync outputs back with 'ellf infra configure --from-terraform' instead of 'ellf infra provision'.
@@ -838,9 +849,10 @@ Generate a values.yaml for Helm deployment from credentials and provider default
 | --- | --- | --- | --- |
 | `--creds` | `Path` | Path to cluster-creds.json from 'infra register' |  |
 | `--cloud-provider` | `str` | Cloud provider: gcp, k3s, aws, azure |  |
-| `--domain` | `str` | Public address the cluster is reached on, host or host:port (e.g. 'cluster.example.com' or 'localhost:8443'). Prefix with 'http://' for plain-HTTP local clusters (e.g. loopback k3s) to skip TLS entirely. Match what was passed to 'infra register' — it flows into ELLF_BROKER_HOST so the cluster emits matching OIDC / token URLs. |  |
+| `--domain` | `str` | Public address the cluster is reached on, host or host:port (e.g. 'cluster.example.com'). Use 'http://localhost' for a cluster on this machine, which needs no certificate and works in every browser but Safari. 'https://localhost[:port]', or https at an IP address on a private network (for other devices to reach), is served with a certificate Ellf issues the cluster, which each device trusts once (see 'ellf infra tls'). Match what was passed to 'infra register' — it flows into ELLF_BROKER_HOST so the cluster emits matching OIDC / token URLs. |  |
 | `--out` | `Path` | Output path for generated values.yaml | `'values.yaml'` |
 | `--acme-email` | `str` | Email for Let's Encrypt certificates | `None` |
+| `--tls-secret-name` | `str` | Serve the cluster with a certificate you provide: the name of a kubernetes.io/tls Secret in the cluster's namespace, made however you like (your own cert-manager issuer, a company CA, by hand). For a cluster on a private network or at an IP address, which Let's Encrypt can't certify. | `None` |
 
 #### `ellf infra provision`
 
@@ -874,7 +886,6 @@ Start a cluster on infrastructure configured under your own cloud account.
 | `src` | `Path` | Path to cluster definition files | `'.'` |
 | `config_path` | `Path` | Path to config yaml | `None` |
 | `--config-key` | `str` | Top-level key for the cluster config. | `None` |
-| `--offline` | `Path` | Path to a credentials JSON file. Deploys without connecting to PAM. | `None` |
 
 ### `ellf jobs`
 

{ellf_cli-22.0.2 → ellf_cli-22.0.4}/ellf_cli/__main__.py

@@ -7,9 +7,9 @@ import truststore
 # Use the OS native trust store (macOS Keychain, /etc/ssl/certs on Linux,
 # Windows certificate store) for every httpx/urllib/requests call this
 # CLI makes — instead of httpx's default certifi bundle — so a CA the
-# machine already trusts (a corporate proxy's, or a dev stack's) is
-# trusted by the browser, curl and the CLI alike, with no SSL_CERT_FILE
-# or separate bundle to maintain.
+# machine already trusts (a corporate proxy's, a dev stack's, or a cluster's
+# CA trusted with `ellf infra tls --trust`) is trusted by the browser, curl
+# and the CLI alike, with no SSL_CERT_FILE or separate bundle to maintain.
 # Must run before any code constructs an ssl.SSLContext, so it sits at
 # module top.
 truststore.inject_into_ssl()

{ellf_cli-22.0.2 → ellf_cli-22.0.4}/ellf_cli/commands/infra/__init__.py

@@ -10,4 +10,5 @@ from . import (  # noqa: F401
     setup,
     start,
     terraform,
+    tls,
 )

{ellf_cli-22.0.2 → ellf_cli-22.0.4}/ellf_cli/commands/infra/_helpers.py

@@ -23,7 +23,7 @@ NonEmptyStr = Annotated[str, StringConstraints(min_length=1)]
 
 class ClusterCredsFile(BaseModel):
     """Schema for cluster-creds.json, written by `infra register` and read by
-    `infra init-values` and `infra start --offline`.
+    `infra init-values`.
 
     cluster_id/upstream_registry are required — nothing downstream can work
     without them. The rest are legitimately blank on a fresh cluster PAM
@@ -482,7 +482,7 @@ def point_managed_dns(
     ip: "str | None",
     hostname: "str | None" = None,
 ) -> None:
-    """Point a cluster's managed subdomain (base + wildcard) at its ingress.
+    """Point a cluster's managed subdomain at its ingress.
 
     No-op for clusters without a managed subdomain (bring-your-own DNS).
     Idempotent server-side, so safe to call on every provision/start.
@@ -491,25 +491,20 @@ def point_managed_dns(
         return
     if ip:
         allocated = client.cluster.allocate_domain(cluster.id, ip=ip)
-        msg.good(
-            f"Pointed managed domain {allocated.fqdn} (and *.{allocated.fqdn}) at {ip}"
-        )
+        msg.good(f"Pointed managed domain {allocated.fqdn} at {ip}")
     elif hostname:
-        # AWS ELBs expose a hostname, never an IP — the records become CNAMEs.
+        # AWS ELBs expose a hostname, never an IP — the record becomes a CNAME.
         allocated = client.cluster.allocate_domain(cluster.id, hostname=hostname)
         if allocated.hostname:
-            msg.good(
-                f"Pointed managed domain {allocated.fqdn} (and "
-                f"*.{allocated.fqdn}) at {hostname} (CNAME)"
-            )
+            msg.good(f"Pointed managed domain {allocated.fqdn} at {hostname} (CNAME)")
         else:
             # A PAM that predates CNAME support silently ignores the
             # hostname field. Never fail a deploy over this — tell the user
             # how to point DNS themselves instead.
             msg.warn(
                 f"This PAM deployment's managed DNS does not support "
-                f"hostname (CNAME) targets yet. Create CNAME records for "
-                f"{cluster.address} and *.{cluster.address} pointing at "
+                f"hostname (CNAME) targets yet. Create a CNAME record for "
+                f"{cluster.address} pointing at "
                 f"{hostname} in your own DNS, or register the cluster with "
                 f"--domain to use bring-your-own DNS."
             )

{ellf_cli-22.0.2 → ellf_cli-22.0.4}/ellf_cli/commands/infra/deploy.py

@@ -2,6 +2,7 @@ import base64
 import json
 import subprocess
 import tempfile
+import time
 from pathlib import Path
 from typing import Optional
 from uuid import UUID
@@ -28,6 +29,7 @@ from ...url import URL
 from .._state import get_auth_state
 from ._config_io import FILL_IN
 from ._helpers import create_image_pull_secret, ensure_traefik, helm_registry_login
+from .tls import MANAGED_TLS_SECRET_NAME
 
 DEFAULT_NAMESPACE = "ellf"
 DEFAULT_RELEASE = "ellf"
@@ -190,7 +192,12 @@ def deploy(
     # 5. Without an ingress controller nothing serves the cluster's domain.
     # k3s bundles Traefik, but Colima (and k3s --disable traefik) turn it off.
     _ensure_ingress_controller(overrides)
-    # 6. Helm upgrade --install
+    # 6. A certificate neither cert-manager nor Ellf (managedTls) issues is
+    # the operator's own, and has to be in place already.
+    operator_tls_secret = provided_tls_secret(overrides)
+    if operator_tls_secret:
+        _require_tls_secret(operator_tls_secret, namespace)
+    # 7. Helm upgrade --install
     if chart is None:
         # Use OCI chart from the registry
         if not registry:
@@ -206,7 +213,7 @@ def deploy(
     else:
         msg.info(f"Installing from local chart {chart}...")
         upgrade(chart, overrides, namespace=namespace, wait=wait)
-    # 7. Every worker type pins jobs to nodes labeled ellf/node-class=<node_class>.
+    # 8. Every worker type pins jobs to nodes labeled ellf/node-class=<node_class>.
     # Cloud node pools get that label from terraform; a hand-built cluster (k3s
     # on a workstation) doesn't, and every job then sits Pending with "didn't
     # match Pod's node affinity/selector". Read the types the chart actually
@@ -214,11 +221,96 @@ def deploy(
     # default) and label the sole node on single-node clusters.
     _ensure_worker_type_labels(namespace)
     msg.good("Deployment complete")
+    if uses_managed_tls(overrides):
+        if wait:
+            _wait_for_managed_certificate(namespace)
+        msg.info(
+            "The cluster is served with a certificate Ellf issues it. On each "
+            "device you open Ellf on, trust it once with: ellf infra tls --trust"
+        )
     if wait:
         msg.info("Running verification checks...")
         preflight_test(release=DEFAULT_RELEASE, namespace=namespace)
 
 
+def uses_managed_tls(overrides: HelmChartOverrides) -> bool:
+    """Whether the cluster's certificate comes from Ellf (managedTls)."""
+    return bool(overrides.managed_tls and overrides.managed_tls.enabled)
+
+
+def provided_tls_secret(overrides: HelmChartOverrides) -> Optional[str]:
+    """The TLS Secret the operator provides, or None when cert-manager,
+    Ellf (managedTls) or the chart (dev clusters' local.tls) makes it."""
+    tls = overrides.ingress.tls if overrides.ingress else None
+    if not (tls and tls.secret_name) or overrides.cert_manager:
+        return None
+    if uses_managed_tls(overrides):
+        return None
+    if overrides.local and overrides.local.tls:
+        return None
+    return tls.secret_name
+
+
+def _wait_for_managed_certificate(
+    namespace: str, timeout: float = 120.0, interval: float = 3.0
+) -> None:
+    """Wait for CPL to write the first certificate from Ellf. Until it does,
+    Traefik serves its own self-signed one."""
+    deadline = time.monotonic() + timeout
+    while True:
+        result = subprocess.run(
+            ["kubectl", "get", "secret", MANAGED_TLS_SECRET_NAME, "-n", namespace],
+            capture_output=True,
+            text=True,
+        )
+        if result.returncode == 0:
+            msg.good("The cluster has its certificate from Ellf")
+            return
+        if time.monotonic() >= deadline:
+            msg.warn(
+                f"The cluster hasn't received its certificate from Ellf yet "
+                f"(Secret {MANAGED_TLS_SECRET_NAME!r}). Check the cpl container's "
+                "logs: kubectl logs -n "
+                f"{namespace} deploy/ellf-broker -c cpl"
+            )
+            return
+        time.sleep(interval)
+
+
+def _require_tls_secret(secret_name: str, namespace: str) -> None:
+    """Fail unless the operator's TLS Secret exists. Without it the ingress
+    would fall back to Traefik's self-signed certificate."""
+    result = subprocess.run(
+        [
+            "kubectl",
+            "get",
+            "secret",
+            secret_name,
+            "-n",
+            namespace,
+            "-o",
+            "jsonpath={.type}",
+        ],
+        capture_output=True,
+        text=True,
+    )
+    if result.returncode != 0:
+        msg.fail(
+            f"The cluster's certificate Secret {secret_name!r} doesn't exist in "
+            f"namespace {namespace!r}. Create it from your certificate and key:\n"
+            f"  kubectl -n {namespace} create secret tls {secret_name} "
+            "--cert=<certificate.pem> --key=<key.pem>"
+        )
+        raise SystemExit(1)
+    if result.stdout.strip() != "kubernetes.io/tls":
+        msg.fail(
+            f"Secret {secret_name!r} has type {result.stdout.strip()!r}; the "
+            "cluster's certificate needs a kubernetes.io/tls Secret "
+            "('kubectl create secret tls')."
+        )
+        raise SystemExit(1)
+
+
 def _placeholder_keys(values: object, prefix: str = "") -> list[str]:
     """Dotted paths of the values ``infra init-values`` left as FILL-IN."""
     if isinstance(values, dict):

{ellf_cli-22.0.2 → ellf_cli-22.0.4}/ellf_cli/commands/infra/init.py

@@ -15,6 +15,7 @@ from ...cluster_config import ClusterConfig
 from ...errors import CLIError
 from ...helm import HelmChartValues, NodePool, PerJob
 from ...interactivity import stdin_isatty
+from ...url import URL
 from ._config_io import FILL_IN, is_placeholder
 from .register import CLOUD_PROVIDERS, ensure_registered
 from .terraform import (
@@ -24,6 +25,7 @@ from .terraform import (
     ensure_ingress_ip,
     record_backend,
 )
+from .tls import address_reachability, pam_certifies
 
 # Per-provider defaults mirroring infra/cluster/config-*-example.yaml.
 _SYSTEM_POOL_MACHINE = {
@@ -169,20 +171,47 @@ def init(
         # Stage 1 covers the cloud path; the k3s deployment isn't
         # representable in ClusterConfig yet, so hand over to the documented
         # local flow after registration.
-        # A cluster on http://localhost needs no certificate; one on a
-        # public domain gets Let's Encrypt through cert-manager.
-        if address.startswith("http://"):
+        # A cluster on http://localhost needs no certificate. One over https
+        # on localhost or at an IP address on a private network gets one
+        # from Ellf (managedTls), which each device then trusts once. One
+        # Let's Encrypt can reach gets its certificate through cert-manager.
+        # Any other (a name the operator's DNS points at a private network,
+        # or a public IP) is served a certificate the operator provides.
+        certified = pam_certifies(address)
+        reachability = (
+            None
+            if address.startswith("http://") or certified
+            else address_reachability(address)
+        )
+        init_values = (
+            "ellf infra init-values --creds cluster-creds.json "
+            f"--cloud-provider k3s --domain {address}"
+        )
+        if address.startswith("http://") or certified:
+            steps = [init_values]
+        elif reachability != "public":
             steps = [
-                "ellf infra init-values --creds cluster-creds.json "
-                f"--cloud-provider k3s --domain {address}",
+                "kubectl create namespace ellf",
+                "kubectl -n ellf create secret tls ellf-tls "
+                "--cert=<certificate.pem> --key=<key.pem>",
+                f"{init_values} --tls-secret-name ellf-tls",
             ]
         else:
             steps = [
                 "ellf infra setup --cert-manager",
-                "ellf infra init-values --creds cluster-creds.json "
-                f"--cloud-provider k3s --domain {address} --acme-email <email>",
+                f"{init_values} --acme-email <email>",
             ]
         steps.append("ellf infra deploy --values values.yaml --wait")
+        if certified:
+            steps.append("ellf infra tls --trust  # on each device you open Ellf on")
+        if reachability == "unresolved":
+            msg.warn(
+                f"{URL.parse(address, scheme='https').hostname} doesn't resolve "
+                "yet. Point it at the cluster in your DNS. If that's a public "
+                "address, Let's Encrypt can issue the certificate instead: run "
+                "'ellf infra setup --cert-manager' and pass --acme-email "
+                "<email> to init-values in place of --tls-secret-name."
+            )
         msg.info("Local (k3s) cluster registered. Continue with the local flow:")
         # Plain prints: wasabi re-wraps its messages, which ran the steps
         # together into one paragraph.

{ellf_cli-22.0.2 → ellf_cli-22.0.4}/ellf_cli/commands/infra/init_values.py

@@ -12,6 +12,7 @@ from ...cli import cli
 from ...helm import IMAGE_PULL_SECRET_NAME
 from ...url import URL
 from ._helpers import ClusterCredsFile
+from .tls import MANAGED_TLS_SECRET_NAME, pam_certifies
 
 CLOUD_PROVIDERS = ("gcp", "k3s", "aws", "azure")
 
@@ -28,15 +29,29 @@ CLOUD_PROVIDERS = ("gcp", "k3s", "aws", "azure")
         "--domain",
         help=(
             "Public address the cluster is reached on, host or host:port "
-            "(e.g. 'cluster.example.com' or 'localhost:8443'). Prefix with "
-            "'http://' for plain-HTTP local clusters (e.g. loopback k3s) to "
-            "skip TLS entirely. Match what was passed to 'infra register' — "
+            "(e.g. 'cluster.example.com'). Use 'http://localhost' for a cluster "
+            "on this machine, which needs no certificate and works in every "
+            "browser but Safari. 'https://localhost[:port]', or https at an IP "
+            "address on a private network (for other devices to reach), is "
+            "served with a certificate Ellf issues the cluster, which each "
+            "device trusts once (see 'ellf infra tls'). Match what was passed "
+            "to 'infra register' — "
             "it flows into ELLF_BROKER_HOST so the cluster emits matching "
             "OIDC / token URLs."
         ),
     ),
     out=Arg("--out", help="Output path for generated values.yaml"),
     acme_email=Arg("--acme-email", help="Email for Let's Encrypt certificates"),
+    tls_secret_name=Arg(
+        "--tls-secret-name",
+        help=(
+            "Serve the cluster with a certificate you provide: the name of a "
+            "kubernetes.io/tls Secret in the cluster's namespace, made however "
+            "you like (your own cert-manager issuer, a company CA, by hand). "
+            "For a cluster on a private network or at an IP address, which "
+            "Let's Encrypt can't certify."
+        ),
+    ),
 )
 def init_values(
     creds: Path,
@@ -44,6 +59,7 @@ def init_values(
     domain: str,
     out: Union[Path, str] = "values.yaml",
     acme_email: Optional[str] = None,
+    tls_secret_name: Optional[str] = None,
 ) -> None:
     """Generate a values.yaml for Helm deployment from credentials and provider defaults."""
     from .._state import get_auth_state
@@ -54,6 +70,18 @@ def init_values(
             f"Choose from: {', '.join(CLOUD_PROVIDERS)}"
         )
         raise SystemExit(1)
+    if acme_email and tls_secret_name:
+        msg.fail(
+            "Pass either --acme-email or --tls-secret-name, not both: Let's "
+            "Encrypt issues the certificate, or you provide it."
+        )
+        raise SystemExit(1)
+    if tls_secret_name == MANAGED_TLS_SECRET_NAME:
+        msg.fail(
+            f"'{MANAGED_TLS_SECRET_NAME}' is the Secret the cluster keeps the "
+            "certificate Ellf issues it in. Name yours something else."
+        )
+        raise SystemExit(1)
     if isinstance(out, str):
         out = Path(out)
     creds_data = srsly.read_json(creds)
@@ -95,6 +123,12 @@ def init_values(
     if acme_email:
         values["ingress"] = {"tls": {"secretName": "ellf-tls"}}
         values["certManager"] = {"acmeEmail": acme_email}
+    elif tls_secret_name:
+        values["ingress"] = {"tls": {"secretName": tls_secret_name}}
+    elif pam_certifies(domain):
+        # No public CA certifies localhost or a private IP: the cluster gets
+        # its certificate from Ellf, which its CPL sidecar keeps current.
+        values["managedTls"] = {"enabled": True}
     if cloud_provider == "k3s":
         # State the selector explicitly rather than relying on the chart
         # default — deploy-time node labeling reads this file, not the chart.

{ellf_cli-22.0.2 → ellf_cli-22.0.4}/ellf_cli/commands/infra/register.py

@@ -50,7 +50,11 @@ class Registration(NamedTuple):
             "Public address the cluster is reached on, host or host:port "
             "(e.g. 'cluster.example.com' for a hosted cluster on port 443, "
             "or 'http://localhost' for a cluster on this machine, which needs "
-            "no certificate and is what the free Solo plan uses). "
+            "no certificate and is what the free Solo plan uses by default; "
+            "Safari can't reach it there, so for Safari use "
+            "'https://localhost[:port]', and to reach it from other devices "
+            "'https://<its IP address on your network>'; Ellf issues those a "
+            "certificate, see 'ellf infra tls'). "
             "Stored verbatim as the cluster address; the chart derives the "
             "bare hostname for K8s ingress / cert SAN where a port isn't allowed. "
             "Omit to get a managed subdomain under an Explosion-controlled zone."
@@ -67,9 +71,10 @@ class Registration(NamedTuple):
     public_ip=Arg(
         "--public-ip",
         help=(
-            "Cluster ingress IP to point the managed subdomain at. Omit to "
-            "reserve the name now and re-run with --public-ip once the "
-            "load balancer IP is known."
+            "Cluster ingress IP to point the managed subdomain at: a public "
+            "IPv4 address. Omit to reserve the name now and re-run with "
+            "--public-ip once the load balancer IP is known. A cluster on a "
+            "private network uses --domain with your own DNS instead."
         ),
     ),
     cloud_provider=Arg(
@@ -107,7 +112,7 @@ def register(
     """Register a new cluster with PAM and write credentials to cluster-creds.json.
 
     Pass --domain to use your own DNS, or omit it to be allocated a managed
-    subdomain (with base + wildcard A records) under an Explosion-controlled
+    subdomain (with an A record) under an Explosion-controlled
     zone. An org on the free Solo plan has no managed subdomain: omitting
     --domain registers it at http://localhost.
     """
@@ -183,11 +188,13 @@ def ensure_registered(
         ),
         None,
     )
-    # Solo's one cluster is on localhost, and PAM refuses it anything else.
+    # Solo's one cluster is on localhost or a private network, and PAM
+    # refuses it anything else; localhost is the default.
     if domain is None and _org_is_solo(client, org_id):
         msg.info(Messages.T074)
-        # Plain http: browsers treat localhost as a secure context, so
-        # the cluster needs no certificate.
+        # Plain http needs no certificate, and every browser but Safari lets
+        # an https page call http://localhost. Safari users opt into
+        # https://localhost with 'ellf infra tls'.
         domain = "http://localhost"
     # With no --domain, register under a placeholder first; the managed
     # subdomain allocation below replaces it with the real FQDN. On
@@ -249,7 +256,7 @@ def ensure_registered(
         allocated_fqdn = allocated.fqdn
         if public_ip:
             msg.good(f"Managed subdomain {allocated.fqdn} -> {public_ip}")
-            msg.info(f"  Created A records for {allocated.fqdn} and *.{allocated.fqdn}")
+            msg.info(f"  Created an A record for {allocated.fqdn}")
         else:
             msg.good(f"Managed subdomain {allocated.fqdn} reserved")
             msg.info(

{ellf_cli-22.0.2 → ellf_cli-22.0.4}/ellf_cli/commands/infra/start.py

@@ -3,7 +3,6 @@
 from pathlib import Path
 from typing import Optional, Union
 
-import srsly
 from radicli import Arg
 from wasabi import msg
 
@@ -17,7 +16,6 @@ from ...helm import (
 )
 from ._config_io import check_deploy_ready, load_cluster_config
 from ._helpers import (
-    ClusterCredsFile,
     create_image_pull_secret,
     ensure_cert_manager,
     ensure_cluster_keypair,
@@ -42,16 +40,11 @@ DEFAULT_NAMESPACE = "ellf"
         "--config-key",
         help="Top-level key for the cluster config.",
     ),
-    offline=Arg(
-        "--offline",
-        help="Path to a credentials JSON file. Deploys without connecting to PAM.",
-    ),
 )
 def start(
     src: Union[Path, str] = ".",
     config_path: Optional[Path] = None,
     config_key: Optional[str] = None,
-    offline: Optional[Path] = None,
 ) -> None:
     """Start a cluster on infrastructure configured under your own cloud account."""
     from .._state import get_auth_state
@@ -65,59 +58,24 @@ def start(
     cloud_provider = config.deployment.cloud_provider
     use_cluster_credentials(config)
     public_key = ensure_cluster_keypair(config.deployment.infra_secret_name)
-    cluster_detail = None
-    dns_client = None
-    if offline is not None:
-        from uuid import UUID
-
-        from ellf_pam_sdk.models import ClusterCredentials, Image, Secrets
-
-        if not config.deployment.pam_domain:
-            from ...errors import CLIError
-
-            raise CLIError(
-                "deployment.pam_domain is required with --offline",
-                "The chart needs the PAM host (e.g. 'app.ellf.ai'). "
-                "Online runs derive it from your login; offline runs must "
-                "set it in config.yaml.",
-            )
-        creds_data = srsly.read_json(offline)
-        assert isinstance(creds_data, dict)
-        creds_file = ClusterCredsFile(**creds_data)
-        creds = ClusterCredentials(
-            cluster_id=UUID(creds_file.cluster_id),
-            public_key=public_key,
-            image=Image(
-                registry=creds_file.upstream_registry,
-                broker_version=creds_file.target_broker_version,
-                cpl_version=creds_file.target_cpl_version,
-            ),
-            secrets=Secrets(
-                container_sa_key=creds_file.container_sa_key,
-                prodigy_license_key=creds_file.prodigy_license_key,
-            ),
-        )
-        values = build_values(config, creds)
-    else:
-        auth = get_auth_state()
-        # The chart hard-requires cluster.pamFqdn; it's not information the
-        # operator should have to supply, so default it from the PAM host
-        # they're already logged in to (mirrors init_values).
-        if not config.deployment.pam_domain:
-            config.deployment.pam_domain = auth.pam_url.netloc
-        ensure_cluster_record(
-            auth.client,
-            auth.org_id,
-            config.deployment.domain,
-            public_key,
-            cluster_name=config.name,
-            cloud_provider=cloud_provider,
-        )
-        cluster_auth, cluster_detail = get_cluster_auth(
-            auth.client, config.deployment.domain
-        )
-        dns_client = auth.client
-        values = build_values(config, cluster_auth)
+    auth = get_auth_state()
+    # The chart hard-requires cluster.pamFqdn; it's not information the
+    # operator should have to supply, so default it from the PAM host
+    # they're already logged in to (mirrors init_values).
+    if not config.deployment.pam_domain:
+        config.deployment.pam_domain = auth.pam_url.netloc
+    ensure_cluster_record(
+        auth.client,
+        auth.org_id,
+        config.deployment.domain,
+        public_key,
+        cluster_name=config.name,
+        cloud_provider=cloud_provider,
+    )
+    cluster_auth, cluster_detail = get_cluster_auth(
+        auth.client, config.deployment.domain
+    )
+    values = build_values(config, cluster_auth)
     assert values.secrets is not None
     assert values.image is not None
     if values.image_pull_secrets and values.secrets.container_sa_key:
@@ -131,11 +89,7 @@ def start(
     ensure_traefik(public_ip=config.deployment.public_ip)
     if config.deployment.acme_email:
         ensure_cert_manager()
-    if (
-        dns_client is not None
-        and cluster_detail is not None
-        and cluster_detail.managed_subdomain
-    ):
+    if cluster_detail.managed_subdomain:
         # Point the managed subdomain at the ingress now that traefik (and
         # so the LoadBalancer) exists — before the chart upgrade, so a chart
         # failure doesn't leave DNS unpointed. On GCP the IP is usually
@@ -151,7 +105,7 @@ def start(
                 lb_ip, lb_hostname = get_traefik_lb_address()
             if lb_ip or lb_hostname:
                 point_managed_dns(
-                    dns_client, cluster_detail, ip=lb_ip, hostname=lb_hostname
+                    auth.client, cluster_detail, ip=lb_ip, hostname=lb_hostname
                 )
             else:
                 msg.info(