ellf-cli 22.0.3__tar.gz → 22.0.5__tar.gz

{ellf_cli-22.0.3/ellf_cli.egg-info → ellf_cli-22.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ellf-cli
-Version: 22.0.3
+Version: 22.0.5
 Summary: Ellf Command Line Interface
 Home-page: https://prodi.gy
 Author: ExplosionAI GmbH

{ellf_cli-22.0.3 → ellf_cli-22.0.5}/README.md

@@ -358,7 +358,7 @@ Get detailed info for a cluster
 | Argument | Type | Description | Default |
 | --- | --- | --- | --- |
 | `name_or_id` | `Union[str, UUID]` | Name or ID of the cluster |  |
-| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'org_id', 'name', 'address', 'state', 'cloud_provider', 'cloud', 'managed_subdomain', 'gcp_project', 'is_hosted'] | `None` |
+| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'org_id', 'name', 'address', 'state', 'cloud_provider', 'cloud', 'managed_subdomain', 'gcp_project', 'is_hosted', 'ca_certificate'] | `None` |
 | `--json` | `bool` | Output the result as JSON | `False` |
 
 #### `ellf clusters update`
@@ -659,14 +659,14 @@ Deploy and manage cluster infrastructure (Kubernetes, TLS, Terraform)
 
 #### `ellf infra register`
 
-Register a new cluster with PAM and write credentials to cluster-creds.json. Pass --domain to use your own DNS, or omit it to be allocated a managed subdomain (with base + wildcard A records) under an Explosion-controlled zone. An org on the free Solo plan has no managed subdomain: omitting --domain registers it at http://localhost.
+Register a new cluster with PAM. Pass --domain to use your own DNS, or omit it to be allocated a managed subdomain (with an A record) under an Explosion-controlled zone. An org on the free Solo plan has no managed subdomain: omitting --domain registers it at http://localhost.
 
 | Argument | Type | Description | Default |
 | --- | --- | --- | --- |
 | `--name` | `str` | Human-readable name for the cluster |  |
-| `--domain` | `str` | Public address the cluster is reached on, host or host:port (e.g. 'cluster.example.com' for a hosted cluster on port 443, or 'http://localhost' for a cluster on this machine, which needs no certificate and is what the free Solo plan uses by default; Safari can't reach it there, so for Safari use 'https://localhost[:port]', see 'ellf infra tls'). Stored verbatim as the cluster address; the chart derives the bare hostname for K8s ingress / cert SAN where a port isn't allowed. Omit to get a managed subdomain under an Explosion-controlled zone. | `None` |
+| `--domain` | `str` | Public address the cluster is reached on, host or host:port (e.g. 'cluster.example.com' for a hosted cluster on port 443, or 'http://localhost' for a cluster on this machine, which needs no certificate and is what the free Solo plan uses by default; Safari can't reach it there, so for Safari use 'https://localhost[:port]', and to reach it from other devices 'https://<its IP address on your network>'; Ellf issues those a certificate, see 'ellf infra tls'). Stored as the cluster address without its scheme, which is https unless you give http://; the chart derives the bare hostname for K8s ingress / cert SAN where a port isn't allowed. Omit to get a managed subdomain under an Explosion-controlled zone. | `None` |
 | `--subdomain` | `str` | Requested label for a managed subdomain (e.g. 'acme' for acme.<zone>). Only valid without --domain; defaults to a slug derived from your org/cluster name. | `None` |
-| `--public-ip` | `str` | Cluster ingress IP to point the managed subdomain at. Omit to reserve the name now and re-run with --public-ip once the load balancer IP is known. | `None` |
+| `--public-ip` | `str` | Cluster ingress IP to point the managed subdomain at: a public IPv4 address. Omit to reserve the name now and re-run with --public-ip once the load balancer IP is known. A cluster on a private network uses --domain with your own DNS instead. | `None` |
 | `--cloud-provider` | `str` | Cloud provider: gcp, k3s, aws, azure |  |
 | `--gcp-project` | `str` | GCP project the cluster is billed under. Recorded on the cluster record as the precondition for cloud-cost collection (see docs/drafts/cloud-costs.md). Re-running register updates it. | `None` |
 | `--hosted` | `bool` | Mark the cluster as Explosion-hosted. Hosted clusters get their metered cloud costs charged back with a margin — Explosion-operators only, not for BYO clusters. | `False` |
@@ -722,14 +722,13 @@ Destroy the cluster infrastructure created by 'infra terraform', including every
 
 #### `ellf infra tls`
 
-Serve a cluster on this machine at https://localhost. Only Safari needs this: it blocks Ellf from calling a cluster at http://localhost, which every other browser allows. Register and deploy the cluster at https://localhost (or https://localhost:<port>) and 'infra deploy' issues its certificate from a CA the CLI keeps, which can only sign for localhost. Then trust that CA once with --trust. Run on the machine the cluster runs on, with kubectl pointed at it.
+Trust the certificate Ellf issues a cluster on localhost or a private network. Such a cluster is served over https with a certificate from a CA Ellf keeps for it, which can only certify the cluster's own address. Run this with --trust on each device you open Ellf on, once. It needs only your Ellf login, not kubectl.
 
 | Argument | Type | Description | Default |
 | --- | --- | --- | --- |
-| `--self-signed` | `bool` | Issue the cluster a certificate from the localhost-only CA | `False` |
-| `--trust` | `bool` | Print the commands to trust the localhost-only CA | `False` |
-| `--status` | `bool` | Show the cluster's TLS setup | `False` |
-| `--namespace` | `str` | Kubernetes namespace | `'ellf'` |
+| `--trust` | `bool` | Fetch the cluster's certificate authority from Ellf and print the commands to trust it on this device | `False` |
+| `--status` | `bool` | Show the certificate authority Ellf keeps for the cluster | `False` |
+| `--cluster` | `str` | Name or ID of the cluster (default: the current one) | `None` |
 | `--output` | `str` | Output format for trust commands: human, json, shell | `'human'` |
 
 #### `ellf infra init`
@@ -844,15 +843,16 @@ Recreate a cluster hibernated with 'ellf infra hibernate'. Starts the database,
 
 #### `ellf infra init-values`
 
-Generate a values.yaml for Helm deployment from credentials and provider defaults.
+Generate a values.yaml for Helm deployment of a registered cluster. The file holds no secrets, so it's safe to keep with the rest of your configuration: 'infra deploy' hands the cluster its registry and licence keys from PAM, and keeps its database password in the cluster.
 
 | Argument | Type | Description | Default |
 | --- | --- | --- | --- |
-| `--creds` | `Path` | Path to cluster-creds.json from 'infra register' |  |
 | `--cloud-provider` | `str` | Cloud provider: gcp, k3s, aws, azure |  |
-| `--domain` | `str` | Public address the cluster is reached on, host or host:port (e.g. 'cluster.example.com'). Use 'http://localhost' for a cluster on this machine, which needs no certificate and works in every browser but Safari; 'https://localhost[:port]' serves it with a certificate from a localhost-only CA the CLI keeps, for Safari (see 'ellf infra tls'). Match what was passed to 'infra register' — it flows into ELLF_BROKER_HOST so the cluster emits matching OIDC / token URLs. |  |
+| `--cluster` | `str` | Name or ID of the registered cluster (default: the one 'infra register' registered last) | `None` |
+| `--domain` | `str` | Public address the cluster is reached on, host or host:port (default: the address it was registered at). Use 'http://localhost' for a cluster on this machine, which needs no certificate and works in every browser but Safari. 'https://localhost[:port]', or https at an IP address on a private network (for other devices to reach), is served with a certificate Ellf issues the cluster, which each device trusts once (see 'ellf infra tls'). It flows into ELLF_BROKER_HOST so the cluster emits matching OIDC / token URLs. | `None` |
 | `--out` | `Path` | Output path for generated values.yaml | `'values.yaml'` |
 | `--acme-email` | `str` | Email for Let's Encrypt certificates | `None` |
+| `--tls-secret-name` | `str` | Serve the cluster with a certificate you provide: the name of a kubernetes.io/tls Secret in the cluster's namespace, made however you like (your own cert-manager issuer, a company CA, by hand). For a cluster on a private network or at an IP address, which Let's Encrypt can't certify. | `None` |
 
 #### `ellf infra provision`
 
@@ -886,7 +886,6 @@ Start a cluster on infrastructure configured under your own cloud account.
 | `src` | `Path` | Path to cluster definition files | `'.'` |
 | `config_path` | `Path` | Path to config yaml | `None` |
 | `--config-key` | `str` | Top-level key for the cluster config. | `None` |
-| `--offline` | `Path` | Path to a credentials JSON file. Deploys without connecting to PAM. | `None` |
 
 ### `ellf jobs`
 

{ellf_cli-22.0.3 → ellf_cli-22.0.5}/ellf_cli/__main__.py

@@ -7,9 +7,9 @@ import truststore
 # Use the OS native trust store (macOS Keychain, /etc/ssl/certs on Linux,
 # Windows certificate store) for every httpx/urllib/requests call this
 # CLI makes — instead of httpx's default certifi bundle — so a CA the
-# machine already trusts (a corporate proxy's, a dev stack's, or the
-# localhost CA from `ellf infra tls`) is trusted by the browser, curl and
-# the CLI alike, with no SSL_CERT_FILE or separate bundle to maintain.
+# machine already trusts (a corporate proxy's, a dev stack's, or a cluster's
+# CA trusted with `ellf infra tls --trust`) is trusted by the browser, curl
+# and the CLI alike, with no SSL_CERT_FILE or separate bundle to maintain.
 # Must run before any code constructs an ssl.SSLContext, so it sits at
 # module top.
 truststore.inject_into_ssl()

{ellf_cli-22.0.3 → ellf_cli-22.0.5}/ellf_cli/cli.py

@@ -1,11 +1,13 @@
 from __future__ import annotations
 
+import dataclasses
 import json
 import sys
 from pathlib import Path
-from typing import Any
+from typing import Any, Callable, TypeVar
 
-from radicli import Radicli, get_list_converter
+from radicli import Arg, Command, Radicli, get_list_converter
+from radicli.util import DEFAULT_PLACEHOLDER, ArgparseArg
 from wasabi import msg
 
 from ellf_broker_sdk.errors import BrokerError
@@ -18,6 +20,8 @@ from .messages import Messages
 
 HELP = """Ellf Command Line Interface."""
 
+_F = TypeVar("_F", bound=Callable[..., Any])
+
 
 def _emit_error(title: str, detail: str | None = None) -> int:
     if not isatty(sys.stderr):
@@ -95,7 +99,40 @@ ERRORS = {
 }
 
 
-cli = Radicli(
+class _Radicli(Radicli):
+    """Radicli that says which options are required in their help.
+
+    radicli checks required options itself rather than through argparse,
+    which would trip over subcommands, so argparse's usage line shows every
+    option in brackets, as if optional. Marked when the command registers,
+    so the static ellf.json the CLI runs from carries it too.
+    """
+
+    def _command(
+        self,
+        name: str,
+        args: dict[str, Arg],
+        registry: dict[str, Command],
+        **kwargs: Any,
+    ) -> Callable[[_F], _F]:
+        register = super()._command(name, args, registry, **kwargs)
+
+        def cli_wrapper(cli_func: _F) -> _F:
+            register(cli_func)
+            command = registry[name]
+            command.args = [_mark_required(arg) for arg in command.args]
+            return cli_func
+
+        return cli_wrapper
+
+
+def _mark_required(arg: ArgparseArg) -> ArgparseArg:
+    if not arg.arg.option or arg.default is not DEFAULT_PLACEHOLDER:
+        return arg
+    return dataclasses.replace(arg, help=f"{arg.help or ''} (required)".lstrip())
+
+
+cli = _Radicli(
     prog=about.__prog__,
     help=HELP,
     version=about.__version__,

{ellf_cli-22.0.3 → ellf_cli-22.0.5}/ellf_cli/cluster_config.py

@@ -1,9 +1,6 @@
 from __future__ import annotations
 
-import json
-import tempfile
-from contextlib import contextmanager
-from typing import Annotated, Iterator, Literal
+from typing import Annotated, Literal
 
 from pydantic import AliasChoices, BaseModel, Field, model_validator
 
@@ -249,14 +246,5 @@ class ClusterConfigOverrides(BaseModel):
     node_pools: list[NodePool] | None = None
     default_worker_type: str | None = None
 
-    @contextmanager
-    def write_to_temp(self) -> Iterator[str]:
-        """Write override values to a temp JSON file, yielding its path."""
-        data = self.model_dump(by_alias=True, exclude_none=True)
-        with tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=True) as tmp:
-            tmp.write(json.dumps(data, indent=2))
-            tmp.flush()
-            yield tmp.name
-
 
 _check_overrides_match(ClusterConfig, ClusterConfigOverrides)

{ellf_cli-22.0.3 → ellf_cli-22.0.5}/ellf_cli/commands/clusters.py

@@ -1,6 +1,7 @@
 import base64
 import builtins
 import json
+import ssl
 import subprocess
 import time
 import uuid
@@ -49,6 +50,24 @@ DEFAULT_NAMESPACE = "ellf"
 DEFAULT_RELEASE = "ellf"
 
 
+def is_untrusted_certificate(exc: BaseException) -> bool:
+    """Whether a connection failed because this device doesn't trust the
+    cluster's certificate, rather than because nothing answered.
+
+    That's how a cluster served with a certificate Ellf issues it (on
+    localhost or a private network) looks until 'ellf infra tls --trust'.
+    httpx reports it as a ConnectError, with the SSL error in its chain.
+    """
+    seen: set[int] = set()
+    current: Optional[BaseException] = exc
+    while current is not None and id(current) not in seen:
+        if isinstance(current, ssl.SSLCertVerificationError):
+            return True
+        seen.add(id(current))
+        current = current.__cause__ or current.__context__
+    return "CERTIFICATE_VERIFY_FAILED" in str(exc)
+
+
 def check_cluster_status(
     cluster: ellf_pam_sdk_models.ClusterSummary,
 ) -> ClusterStatusCheck:
@@ -68,7 +87,9 @@ def check_cluster_status(
             return ClusterStatusCheck.ISSUES
     except InvalidURL:
         return ClusterStatusCheck.INVALID_ADDRESS
-    except (ConnectTimeout, ConnectError):
+    except (ConnectTimeout, ConnectError) as e:
+        if is_untrusted_certificate(e):
+            return ClusterStatusCheck.UNTRUSTED_CERTIFICATE
         # This could mean the cluster is down, but could also mean we have no network access
         return ClusterStatusCheck.NOT_FOUND
     except RequestError as e:
@@ -312,13 +333,12 @@ def _check_result(
     label: str, ok: bool, detail: str = "", *, quiet: bool = False
 ) -> tuple[str, bool, str]:
     """Print a check result line (unless quiet) and return (label, ok, detail)."""
-    symbol = "\u2714" if ok else "\u2718"
     suffix = f" ({detail})" if detail else ""
     if not quiet:
         if ok:
-            msg.good(f"{symbol} {label}{suffix}")
+            msg.good(f"{label}{suffix}")
         else:
-            msg.fail(f"{symbol} {label}{suffix}")
+            msg.fail(f"{label}{suffix}")
     return (label, ok, detail)
 
 
@@ -387,12 +407,17 @@ def check(
                     quiet=as_json,
                 )
             )
-    except (httpx.ConnectError, httpx.ConnectTimeout):
+    except (httpx.ConnectError, httpx.ConnectTimeout) as exc:
         results.append(
             _check_result(
                 f"Cluster API responding on {broker_url}",
                 False,
-                detail="connection failed",
+                detail=(
+                    "this device doesn't trust the cluster's certificate: "
+                    "run 'ellf infra tls --trust'"
+                    if is_untrusted_certificate(exc)
+                    else "connection failed"
+                ),
                 quiet=as_json,
             )
         )

{ellf_cli-22.0.3 → ellf_cli-22.0.5}/ellf_cli/commands/infra/_helpers.py

@@ -2,13 +2,14 @@
 
 import base64
 import json
+import os
 import subprocess
 import tempfile
+from contextlib import contextmanager
 from pathlib import Path
-from typing import TYPE_CHECKING, Annotated
+from typing import TYPE_CHECKING, ContextManager, Iterator, Optional
 from uuid import UUID
 
-from pydantic import AliasChoices, BaseModel, Field, StringConstraints
 from wasabi import msg
 
 from ellf_pam_sdk import Client
@@ -17,32 +18,6 @@ from ellf_pam_sdk.models import ClusterCredentials, ClusterDetail
 if TYPE_CHECKING:
     from ...cluster_config import ClusterConfig
 
-# Matches pam/ellf_pam/config.py's NonEmptyStr convention.
-NonEmptyStr = Annotated[str, StringConstraints(min_length=1)]
-
-
-class ClusterCredsFile(BaseModel):
-    """Schema for cluster-creds.json, written by `infra register` and read by
-    `infra init-values` and `infra start --offline`.
-
-    cluster_id/upstream_registry are required — nothing downstream can work
-    without them. The rest are legitimately blank on a fresh cluster PAM
-    hasn't released anything to yet (callers warn, not fail, on those).
-    """
-
-    cluster_id: NonEmptyStr
-    # The upstream Ellf registry the cluster pulls release images from.
-    # Renamed from the ambiguous 'container_registry' (which read like the
-    # cluster's own registry); creds files written before the rename are
-    # still read via the alias.
-    upstream_registry: NonEmptyStr = Field(
-        validation_alias=AliasChoices("upstream_registry", "container_registry")
-    )
-    container_sa_key: str = ""
-    prodigy_license_key: str = ""
-    target_broker_version: str = ""
-    target_cpl_version: str = ""
-
 
 # Tolerations for the system node-pool taint the terraform modules apply:
 # ellf/role=system on GKE and EKS, and AKS's own CriticalAddonsOnly on AKS,
@@ -419,25 +394,57 @@ def ensure_cert_manager() -> None:
         Path(tmp_path).unlink(missing_ok=True)
 
 
-def helm_registry_login(registry: str, sa_key_b64: str) -> None:
-    """Authenticate the local Helm client to an OCI registry.
+# A registry config helm reads no credentials from but still treats as
+# configured. Given a config with no credentials at all, helm falls back to the
+# OS credential store (the macOS keychain, Docker's credsStore), reading
+# whatever is stored there for the host and saving any login into it.
+_NO_CREDENTIALS_HOST = "ellf.invalid"
+
 
-    The image pull secret only covers the kubelet; Helm's chart pull runs on
-    the workstation and needs its own login. Creds persist in
-    ~/.config/helm/registry/config.json, and the login is idempotent.
+@contextmanager
+def helm_registry_config(
+    registry: Optional[str] = None, sa_key_b64: Optional[str] = None
+) -> Iterator[Path]:
+    """A throwaway helm registry config, deleted on exit.
+
+    Pass it to helm with --registry-config. Without *registry* and
+    *sa_key_b64* it holds no credentials, for a chart anyone can pull, and
+    keeps helm away from the OS credential store. With them it holds the
+    registry key for the registry's host: the cluster's own credential, which
+    otherwise would stay in the installer's keychain, and replace whatever
+    they had stored for that host, long after the deploy.
     """
-    host = registry.split("/", 1)[0]
-    sa_key_json = base64.b64decode(sa_key_b64, validate=True).decode("utf-8")
-    result = subprocess.run(
-        ["helm", "registry", "login", host, "-u", "_json_key", "--password-stdin"],
-        input=sa_key_json,
-        text=True,
-        capture_output=True,
-    )
-    if result.returncode != 0:
-        msg.fail(f"helm registry login failed for {host}: {result.stderr.strip()}")
+    auths: dict[str, dict[str, str]] = {_NO_CREDENTIALS_HOST: {}}
+    if registry and sa_key_b64:
+        host = registry.split("/", 1)[0]
+        sa_key_json = base64.b64decode(sa_key_b64, validate=True).decode("utf-8")
+        token = base64.b64encode(f"_json_key:{sa_key_json}".encode()).decode()
+        auths[host] = {"auth": token}
+    with tempfile.TemporaryDirectory(prefix="ellf-helm-") as tmp:
+        path = Path(tmp) / "registry.json"
+        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        with os.fdopen(fd, "w") as f:
+            json.dump({"auths": auths}, f)
+        yield path
+
+
+def chart_source(
+    creds: ClusterCredentials, registry: Optional[str], sa_key_b64: Optional[str]
+) -> "tuple[str, ContextManager[Path]]":
+    """The chart to install and the helm registry config to pull it with.
+
+    PAM names a chart anyone can pull, which needs no credentials. A PAM
+    that predates the public chart repository names none: the chart is then
+    only in the upstream registry, behind the registry key.
+    """
+    if creds.image.chart:
+        return creds.image.chart, helm_registry_config()
+    if not registry:
+        msg.fail(
+            "registries.upstream (or legacy image.registry) is empty in values.yaml"
+        )
         raise SystemExit(1)
-    msg.info(f"Authenticated Helm to {host}")
+    return f"oci://{registry}/ellf", helm_registry_config(registry, sa_key_b64)
 
 
 def get_cluster_auth(
@@ -482,7 +489,7 @@ def point_managed_dns(
     ip: "str | None",
     hostname: "str | None" = None,
 ) -> None:
-    """Point a cluster's managed subdomain (base + wildcard) at its ingress.
+    """Point a cluster's managed subdomain at its ingress.
 
     No-op for clusters without a managed subdomain (bring-your-own DNS).
     Idempotent server-side, so safe to call on every provision/start.
@@ -491,25 +498,20 @@ def point_managed_dns(
         return
     if ip:
         allocated = client.cluster.allocate_domain(cluster.id, ip=ip)
-        msg.good(
-            f"Pointed managed domain {allocated.fqdn} (and *.{allocated.fqdn}) at {ip}"
-        )
+        msg.good(f"Pointed managed domain {allocated.fqdn} at {ip}")
     elif hostname:
-        # AWS ELBs expose a hostname, never an IP — the records become CNAMEs.
+        # AWS ELBs expose a hostname, never an IP — the record becomes a CNAME.
         allocated = client.cluster.allocate_domain(cluster.id, hostname=hostname)
         if allocated.hostname:
-            msg.good(
-                f"Pointed managed domain {allocated.fqdn} (and "
-                f"*.{allocated.fqdn}) at {hostname} (CNAME)"
-            )
+            msg.good(f"Pointed managed domain {allocated.fqdn} at {hostname} (CNAME)")
         else:
             # A PAM that predates CNAME support silently ignores the
             # hostname field. Never fail a deploy over this — tell the user
             # how to point DNS themselves instead.
             msg.warn(
                 f"This PAM deployment's managed DNS does not support "
-                f"hostname (CNAME) targets yet. Create CNAME records for "
-                f"{cluster.address} and *.{cluster.address} pointing at "
+                f"hostname (CNAME) targets yet. Create a CNAME record for "
+                f"{cluster.address} pointing at "
                 f"{hostname} in your own DNS, or register the cluster with "
                 f"--domain to use bring-your-own DNS."
             )