ellf-cli 22.0.4__tar.gz → 22.0.6__tar.gz

{ellf_cli-22.0.4/ellf_cli.egg-info → ellf_cli-22.0.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ellf-cli
-Version: 22.0.4
+Version: 22.0.6
 Summary: Ellf Command Line Interface
 Home-page: https://prodi.gy
 Author: ExplosionAI GmbH

{ellf_cli-22.0.4 → ellf_cli-22.0.6}/README.md

@@ -32,7 +32,7 @@ List the actions in a project. Uses your default project unless --project is giv
 | Argument | Type | Description | Default |
 | --- | --- | --- | --- |
 | `--project` | `str` | Name, slug, or ID of action's project or the last project if not set | `None` |
-| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'cluster_id', 'name', 'project_id', 'job_type', 'plan', 'cli_command', 'stats', 'created_by_user', 'state'] | `['id', 'name', 'state']` |
+| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'cluster_id', 'name', 'project_id', 'job_type', 'plan', 'cli_command', 'stats', 'created_by_user', 'created_by_deleted', 'state'] | `['id', 'name', 'state']` |
 | `--json` | `bool` | Output the result as JSON | `False` |
 
 #### `ellf actions info`
@@ -44,7 +44,7 @@ Print information about an action on the cluster
 | `name_or_id` | `Union[str, UUID]` | Name or ID of the action |  |
 | `--project` | `str` | Name, slug, or ID of action's project or the last project if not set | `None` |
 | `--cluster` | `str` | Name, slug, or ID of the cluster to search for action name (or the last cluster if not set) | `None` |
-| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'cluster_id', 'name', 'project_id', 'job_type', 'plan', 'cli_command', 'stats', 'created_by_user', 'recipe_name', 'recipe_title', 'evaluation', 'project_name', 'error', 'executions', 'last_execution_id', 'url_logs', 'url', 'related_tasks'] | `None` |
+| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'cluster_id', 'name', 'project_id', 'job_type', 'plan', 'cli_command', 'stats', 'created_by_user', 'created_by_deleted', 'recipe_name', 'recipe_title', 'evaluation', 'project_name', 'error', 'executions', 'last_execution_id', 'url_logs', 'url', 'related_tasks'] | `None` |
 | `--json` | `bool` | Output the result as JSON | `False` |
 
 #### `ellf actions logs`
@@ -215,7 +215,7 @@ List the agents in a project. Uses your default project unless --project is give
 | Argument | Type | Description | Default |
 | --- | --- | --- | --- |
 | `--project` | `str` | Name, slug, or ID of agent's project or the last project if not set | `None` |
-| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'cluster_id', 'name', 'project_id', 'job_type', 'plan', 'cli_command', 'last_execution_started', 'icon', 'created_by_user', 'live_sessions', 'state'] | `['id', 'name', 'state']` |
+| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'cluster_id', 'name', 'project_id', 'job_type', 'plan', 'cli_command', 'last_execution_started', 'icon', 'created_by_user', 'created_by_deleted', 'live_sessions', 'state'] | `['id', 'name', 'state']` |
 | `--json` | `bool` | Output the result as JSON | `False` |
 
 #### `ellf agents info`
@@ -227,7 +227,7 @@ Print information about an agent on the cluster
 | `name_or_id` | `Union[str, UUID]` | Name or ID of the agent |  |
 | `--project` | `str` | Name, slug, or ID of agent's project or the last project if not set | `None` |
 | `--cluster` | `str` | Name, slug, or ID of the cluster to search for agent name (or the last cluster if not set) | `None` |
-| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'cluster_id', 'name', 'project_id', 'job_type', 'plan', 'cli_command', 'last_execution_started', 'icon', 'created_by_user', 'live_sessions', 'recipe_name', 'recipe_title', 'project_name', 'error', 'last_execution_id', 'related_tasks'] | `None` |
+| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'cluster_id', 'name', 'project_id', 'job_type', 'plan', 'cli_command', 'last_execution_started', 'icon', 'created_by_user', 'created_by_deleted', 'live_sessions', 'recipe_name', 'recipe_title', 'project_name', 'error', 'last_execution_id', 'related_tasks'] | `None` |
 | `--json` | `bool` | Output the result as JSON | `False` |
 
 #### `ellf agents logs`
@@ -659,12 +659,12 @@ Deploy and manage cluster infrastructure (Kubernetes, TLS, Terraform)
 
 #### `ellf infra register`
 
-Register a new cluster with PAM and write credentials to cluster-creds.json. Pass --domain to use your own DNS, or omit it to be allocated a managed subdomain (with an A record) under an Explosion-controlled zone. An org on the free Solo plan has no managed subdomain: omitting --domain registers it at http://localhost.
+Register a new cluster with PAM. Pass --domain to use your own DNS, or omit it to be allocated a managed subdomain (with an A record) under an Explosion-controlled zone. An org on the free Solo plan has no managed subdomain: omitting --domain registers it at http://localhost.
 
 | Argument | Type | Description | Default |
 | --- | --- | --- | --- |
 | `--name` | `str` | Human-readable name for the cluster |  |
-| `--domain` | `str` | Public address the cluster is reached on, host or host:port (e.g. 'cluster.example.com' for a hosted cluster on port 443, or 'http://localhost' for a cluster on this machine, which needs no certificate and is what the free Solo plan uses by default; Safari can't reach it there, so for Safari use 'https://localhost[:port]', and to reach it from other devices 'https://<its IP address on your network>'; Ellf issues those a certificate, see 'ellf infra tls'). Stored verbatim as the cluster address; the chart derives the bare hostname for K8s ingress / cert SAN where a port isn't allowed. Omit to get a managed subdomain under an Explosion-controlled zone. | `None` |
+| `--domain` | `str` | Public address the cluster is reached on, host or host:port (e.g. 'cluster.example.com' for a hosted cluster on port 443, or 'http://localhost' for a cluster on this machine, which needs no certificate and is what the free Solo plan uses by default; Safari can't reach it there, so for Safari use 'https://localhost[:port]', and to reach it from other devices 'https://<its IP address on your network>'; Ellf issues those a certificate, see 'ellf infra tls'). Stored as the cluster address without its scheme, which is https unless you give http://; the chart derives the bare hostname for K8s ingress / cert SAN where a port isn't allowed. Omit to get a managed subdomain under an Explosion-controlled zone. | `None` |
 | `--subdomain` | `str` | Requested label for a managed subdomain (e.g. 'acme' for acme.<zone>). Only valid without --domain; defaults to a slug derived from your org/cluster name. | `None` |
 | `--public-ip` | `str` | Cluster ingress IP to point the managed subdomain at: a public IPv4 address. Omit to reserve the name now and re-run with --public-ip once the load balancer IP is known. A cluster on a private network uses --domain with your own DNS instead. | `None` |
 | `--cloud-provider` | `str` | Cloud provider: gcp, k3s, aws, azure |  |
@@ -843,13 +843,13 @@ Recreate a cluster hibernated with 'ellf infra hibernate'. Starts the database,
 
 #### `ellf infra init-values`
 
-Generate a values.yaml for Helm deployment from credentials and provider defaults.
+Generate a values.yaml for Helm deployment of a registered cluster. The file holds no secrets, so it's safe to keep with the rest of your configuration: 'infra deploy' hands the cluster its registry and licence keys from PAM, and keeps its database password in the cluster.
 
 | Argument | Type | Description | Default |
 | --- | --- | --- | --- |
-| `--creds` | `Path` | Path to cluster-creds.json from 'infra register' |  |
 | `--cloud-provider` | `str` | Cloud provider: gcp, k3s, aws, azure |  |
-| `--domain` | `str` | Public address the cluster is reached on, host or host:port (e.g. 'cluster.example.com'). Use 'http://localhost' for a cluster on this machine, which needs no certificate and works in every browser but Safari. 'https://localhost[:port]', or https at an IP address on a private network (for other devices to reach), is served with a certificate Ellf issues the cluster, which each device trusts once (see 'ellf infra tls'). Match what was passed to 'infra register' — it flows into ELLF_BROKER_HOST so the cluster emits matching OIDC / token URLs. |  |
+| `--cluster` | `str` | Name or ID of the registered cluster (default: the one 'infra register' registered last) | `None` |
+| `--domain` | `str` | Public address the cluster is reached on, host or host:port (default: the address it was registered at). Use 'http://localhost' for a cluster on this machine, which needs no certificate and works in every browser but Safari. 'https://localhost[:port]', or https at an IP address on a private network (for other devices to reach), is served with a certificate Ellf issues the cluster, which each device trusts once (see 'ellf infra tls'). It flows into ELLF_BROKER_HOST so the cluster emits matching OIDC / token URLs. | `None` |
 | `--out` | `Path` | Output path for generated values.yaml | `'values.yaml'` |
 | `--acme-email` | `str` | Email for Let's Encrypt certificates | `None` |
 | `--tls-secret-name` | `str` | Serve the cluster with a certificate you provide: the name of a kubernetes.io/tls Secret in the cluster's namespace, made however you like (your own cert-manager issuer, a company CA, by hand). For a cluster on a private network or at an IP address, which Let's Encrypt can't certify. | `None` |
@@ -1255,7 +1255,7 @@ List the services in a project. Uses your default project unless --project is gi
 | Argument | Type | Description | Default |
 | --- | --- | --- | --- |
 | `--project` | `str` | Name, slug, or ID of service's project or the last project if not set | `None` |
-| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'cluster_id', 'name', 'project_id', 'job_type', 'plan', 'cli_command', 'last_execution_started', 'created_by_user', 'state'] | `['id', 'name', 'state']` |
+| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'cluster_id', 'name', 'project_id', 'job_type', 'plan', 'cli_command', 'last_execution_started', 'created_by_user', 'created_by_deleted', 'state'] | `['id', 'name', 'state']` |
 | `--json` | `bool` | Output the result as JSON | `False` |
 
 #### `ellf services info`
@@ -1267,7 +1267,7 @@ Print information about a service on the cluster.
 | `name_or_id` | `Union[str, UUID]` | Name or ID of the service |  |
 | `--project` | `str` | Name, slug, or ID of service's project or the last project if not set | `None` |
 | `--cluster` | `str` | Name, slug, or ID of the cluster to search for service name (or the last cluster if not set) | `None` |
-| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'cluster_id', 'name', 'project_id', 'job_type', 'plan', 'cli_command', 'last_execution_started', 'created_by_user', 'recipe_name', 'recipe_title', 'project_name', 'error', 'last_execution_id', 'url', 'url_ui', 'url_logs'] | `None` |
+| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'cluster_id', 'name', 'project_id', 'job_type', 'plan', 'cli_command', 'last_execution_started', 'created_by_user', 'created_by_deleted', 'recipe_name', 'recipe_title', 'project_name', 'error', 'last_execution_id', 'url', 'url_ui', 'url_logs'] | `None` |
 | `--json` | `bool` | Output the result as JSON | `False` |
 
 #### `ellf services logs`
@@ -1418,7 +1418,7 @@ List the tasks in a project. Uses your default project unless --project is given
 | Argument | Type | Description | Default |
 | --- | --- | --- | --- |
 | `--project` | `str` | Name, slug, or ID of task's project or the last project if not set | `None` |
-| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'project_id', 'cluster_id', 'name', 'recipe_name', 'recipe_title', 'project_name', 'error', 'plan', 'job_type', 'cli_command', 'last_execution_started', 'created_by_user', 'state'] | `['id', 'name', 'state']` |
+| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'project_id', 'cluster_id', 'name', 'recipe_name', 'recipe_title', 'project_name', 'error', 'plan', 'job_type', 'cli_command', 'last_execution_started', 'created_by_user', 'created_by_deleted', 'state'] | `['id', 'name', 'state']` |
 | `--json` | `bool` | Output the result as JSON | `False` |
 
 #### `ellf tasks info`
@@ -1430,7 +1430,7 @@ Print information about a task on the cluster
 | `name_or_id` | `Union[str, UUID]` | Name or ID of the task |  |
 | `--project` | `str` | Name, slug, or ID of task's project or the last project if not set | `None` |
 | `--cluster` | `str` | Name, slug, or ID of the cluster to search for task name (or the last cluster if not set) | `None` |
-| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'project_id', 'cluster_id', 'name', 'recipe_name', 'recipe_title', 'project_name', 'error', 'plan', 'job_type', 'cli_command', 'last_execution_started', 'created_by_user', 'last_execution_id', 'related_actions', 'url_logs', 'url'] | `None` |
+| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'project_id', 'cluster_id', 'name', 'recipe_name', 'recipe_title', 'project_name', 'error', 'plan', 'job_type', 'cli_command', 'last_execution_started', 'created_by_user', 'created_by_deleted', 'last_execution_id', 'related_actions', 'url_logs', 'url'] | `None` |
 | `--json` | `bool` | Output the result as JSON | `False` |
 
 #### `ellf tasks logs`
@@ -1546,7 +1546,7 @@ Remove a user from the organization. By default the user is deactivated: they lo
 | Argument | Type | Description | Default |
 | --- | --- | --- | --- |
 | `email_name_or_id` | `Union[str, UUID]` | Email, name, or ID of the user |  |
-| `--permanent` | `bool` | Permanently delete the user's record instead of deactivating them. This removes their sessions and roles and can't be undone | `False` |
+| `--permanent` | `bool` | Permanently delete the user's record instead of deactivating them. Their annotations, sessions and plans are kept but attributed to a deleted user. This can't be undone | `False` |
 | `--json` | `bool` | Output the result as JSON | `False` |
 
 #### `ellf users reactivate`
@@ -1576,7 +1576,7 @@ List pending invitations
 
 | Argument | Type | Description | Default |
 | --- | --- | --- | --- |
-| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'org_id', 'email', 'avatar_color', 'avatar_url', 'claimed', 'vars', 'created_by_id', 'role'] | `['id', 'email', 'role', 'claimed']` |
+| `--select` | `list[str]` | Comma-separated fields to select and show in output. Available: ['id', 'created', 'updated', 'org_id', 'email', 'avatar_color', 'avatar_url', 'claimed', 'vars', 'created_by_id', 'created_by_deleted', 'role'] | `['id', 'email', 'role', 'claimed']` |
 | `--all` | `bool` | Also include invitations that have already been claimed | `False` |
 | `--json` | `bool` | Output the result as JSON | `False` |
 

{ellf_cli-22.0.4 → ellf_cli-22.0.6}/ellf_cli/cli.py

@@ -1,11 +1,13 @@
 from __future__ import annotations
 
+import dataclasses
 import json
 import sys
 from pathlib import Path
-from typing import Any
+from typing import Any, Callable, TypeVar
 
-from radicli import Radicli, get_list_converter
+from radicli import Arg, Command, Radicli, get_list_converter
+from radicli.util import DEFAULT_PLACEHOLDER, ArgparseArg
 from wasabi import msg
 
 from ellf_broker_sdk.errors import BrokerError
@@ -18,6 +20,8 @@ from .messages import Messages
 
 HELP = """Ellf Command Line Interface."""
 
+_F = TypeVar("_F", bound=Callable[..., Any])
+
 
 def _emit_error(title: str, detail: str | None = None) -> int:
     if not isatty(sys.stderr):
@@ -95,7 +99,40 @@ ERRORS = {
 }
 
 
-cli = Radicli(
+class _Radicli(Radicli):
+    """Radicli that says which options are required in their help.
+
+    radicli checks required options itself rather than through argparse,
+    which would trip over subcommands, so argparse's usage line shows every
+    option in brackets, as if optional. Marked when the command registers,
+    so the static ellf.json the CLI runs from carries it too.
+    """
+
+    def _command(
+        self,
+        name: str,
+        args: dict[str, Arg],
+        registry: dict[str, Command],
+        **kwargs: Any,
+    ) -> Callable[[_F], _F]:
+        register = super()._command(name, args, registry, **kwargs)
+
+        def cli_wrapper(cli_func: _F) -> _F:
+            register(cli_func)
+            command = registry[name]
+            command.args = [_mark_required(arg) for arg in command.args]
+            return cli_func
+
+        return cli_wrapper
+
+
+def _mark_required(arg: ArgparseArg) -> ArgparseArg:
+    if not arg.arg.option or arg.default is not DEFAULT_PLACEHOLDER:
+        return arg
+    return dataclasses.replace(arg, help=f"{arg.help or ''} (required)".lstrip())
+
+
+cli = _Radicli(
     prog=about.__prog__,
     help=HELP,
     version=about.__version__,

{ellf_cli-22.0.4 → ellf_cli-22.0.6}/ellf_cli/cluster_config.py

@@ -1,9 +1,6 @@
 from __future__ import annotations
 
-import json
-import tempfile
-from contextlib import contextmanager
-from typing import Annotated, Iterator, Literal
+from typing import Annotated, Literal
 
 from pydantic import AliasChoices, BaseModel, Field, model_validator
 
@@ -249,14 +246,5 @@ class ClusterConfigOverrides(BaseModel):
     node_pools: list[NodePool] | None = None
     default_worker_type: str | None = None
 
-    @contextmanager
-    def write_to_temp(self) -> Iterator[str]:
-        """Write override values to a temp JSON file, yielding its path."""
-        data = self.model_dump(by_alias=True, exclude_none=True)
-        with tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=True) as tmp:
-            tmp.write(json.dumps(data, indent=2))
-            tmp.flush()
-            yield tmp.name
-
 
 _check_overrides_match(ClusterConfig, ClusterConfigOverrides)

{ellf_cli-22.0.4 → ellf_cli-22.0.6}/ellf_cli/commands/clusters.py

@@ -1,6 +1,7 @@
 import base64
 import builtins
 import json
+import ssl
 import subprocess
 import time
 import uuid
@@ -49,6 +50,24 @@ DEFAULT_NAMESPACE = "ellf"
 DEFAULT_RELEASE = "ellf"
 
 
+def is_untrusted_certificate(exc: BaseException) -> bool:
+    """Whether a connection failed because this device doesn't trust the
+    cluster's certificate, rather than because nothing answered.
+
+    That's how a cluster served with a certificate Ellf issues it (on
+    localhost or a private network) looks until 'ellf infra tls --trust'.
+    httpx reports it as a ConnectError, with the SSL error in its chain.
+    """
+    seen: set[int] = set()
+    current: Optional[BaseException] = exc
+    while current is not None and id(current) not in seen:
+        if isinstance(current, ssl.SSLCertVerificationError):
+            return True
+        seen.add(id(current))
+        current = current.__cause__ or current.__context__
+    return "CERTIFICATE_VERIFY_FAILED" in str(exc)
+
+
 def check_cluster_status(
     cluster: ellf_pam_sdk_models.ClusterSummary,
 ) -> ClusterStatusCheck:
@@ -68,7 +87,9 @@ def check_cluster_status(
             return ClusterStatusCheck.ISSUES
     except InvalidURL:
         return ClusterStatusCheck.INVALID_ADDRESS
-    except (ConnectTimeout, ConnectError):
+    except (ConnectTimeout, ConnectError) as e:
+        if is_untrusted_certificate(e):
+            return ClusterStatusCheck.UNTRUSTED_CERTIFICATE
         # This could mean the cluster is down, but could also mean we have no network access
         return ClusterStatusCheck.NOT_FOUND
     except RequestError as e:
@@ -312,13 +333,12 @@ def _check_result(
     label: str, ok: bool, detail: str = "", *, quiet: bool = False
 ) -> tuple[str, bool, str]:
     """Print a check result line (unless quiet) and return (label, ok, detail)."""
-    symbol = "\u2714" if ok else "\u2718"
     suffix = f" ({detail})" if detail else ""
     if not quiet:
         if ok:
-            msg.good(f"{symbol} {label}{suffix}")
+            msg.good(f"{label}{suffix}")
         else:
-            msg.fail(f"{symbol} {label}{suffix}")
+            msg.fail(f"{label}{suffix}")
     return (label, ok, detail)
 
 
@@ -387,12 +407,17 @@ def check(
                     quiet=as_json,
                 )
             )
-    except (httpx.ConnectError, httpx.ConnectTimeout):
+    except (httpx.ConnectError, httpx.ConnectTimeout) as exc:
         results.append(
             _check_result(
                 f"Cluster API responding on {broker_url}",
                 False,
-                detail="connection failed",
+                detail=(
+                    "this device doesn't trust the cluster's certificate: "
+                    "run 'ellf infra tls --trust'"
+                    if is_untrusted_certificate(exc)
+                    else "connection failed"
+                ),
                 quiet=as_json,
             )
         )

{ellf_cli-22.0.4 → ellf_cli-22.0.6}/ellf_cli/commands/infra/_helpers.py

@@ -2,13 +2,14 @@
 
 import base64
 import json
+import os
 import subprocess
 import tempfile
+from contextlib import contextmanager
 from pathlib import Path
-from typing import TYPE_CHECKING, Annotated
+from typing import TYPE_CHECKING, ContextManager, Iterator, Optional
 from uuid import UUID
 
-from pydantic import AliasChoices, BaseModel, Field, StringConstraints
 from wasabi import msg
 
 from ellf_pam_sdk import Client
@@ -17,32 +18,6 @@ from ellf_pam_sdk.models import ClusterCredentials, ClusterDetail
 if TYPE_CHECKING:
     from ...cluster_config import ClusterConfig
 
-# Matches pam/ellf_pam/config.py's NonEmptyStr convention.
-NonEmptyStr = Annotated[str, StringConstraints(min_length=1)]
-
-
-class ClusterCredsFile(BaseModel):
-    """Schema for cluster-creds.json, written by `infra register` and read by
-    `infra init-values`.
-
-    cluster_id/upstream_registry are required — nothing downstream can work
-    without them. The rest are legitimately blank on a fresh cluster PAM
-    hasn't released anything to yet (callers warn, not fail, on those).
-    """
-
-    cluster_id: NonEmptyStr
-    # The upstream Ellf registry the cluster pulls release images from.
-    # Renamed from the ambiguous 'container_registry' (which read like the
-    # cluster's own registry); creds files written before the rename are
-    # still read via the alias.
-    upstream_registry: NonEmptyStr = Field(
-        validation_alias=AliasChoices("upstream_registry", "container_registry")
-    )
-    container_sa_key: str = ""
-    prodigy_license_key: str = ""
-    target_broker_version: str = ""
-    target_cpl_version: str = ""
-
 
 # Tolerations for the system node-pool taint the terraform modules apply:
 # ellf/role=system on GKE and EKS, and AKS's own CriticalAddonsOnly on AKS,
@@ -419,25 +394,57 @@ def ensure_cert_manager() -> None:
         Path(tmp_path).unlink(missing_ok=True)
 
 
-def helm_registry_login(registry: str, sa_key_b64: str) -> None:
-    """Authenticate the local Helm client to an OCI registry.
+# A registry config helm reads no credentials from but still treats as
+# configured. Given a config with no credentials at all, helm falls back to the
+# OS credential store (the macOS keychain, Docker's credsStore), reading
+# whatever is stored there for the host and saving any login into it.
+_NO_CREDENTIALS_HOST = "ellf.invalid"
+
+
+@contextmanager
+def helm_registry_config(
+    registry: Optional[str] = None, sa_key_b64: Optional[str] = None
+) -> Iterator[Path]:
+    """A throwaway helm registry config, deleted on exit.
 
-    The image pull secret only covers the kubelet; Helm's chart pull runs on
-    the workstation and needs its own login. Creds persist in
-    ~/.config/helm/registry/config.json, and the login is idempotent.
+    Pass it to helm with --registry-config. Without *registry* and
+    *sa_key_b64* it holds no credentials, for a chart anyone can pull, and
+    keeps helm away from the OS credential store. With them it holds the
+    registry key for the registry's host: the cluster's own credential, which
+    otherwise would stay in the installer's keychain, and replace whatever
+    they had stored for that host, long after the deploy.
     """
-    host = registry.split("/", 1)[0]
-    sa_key_json = base64.b64decode(sa_key_b64, validate=True).decode("utf-8")
-    result = subprocess.run(
-        ["helm", "registry", "login", host, "-u", "_json_key", "--password-stdin"],
-        input=sa_key_json,
-        text=True,
-        capture_output=True,
-    )
-    if result.returncode != 0:
-        msg.fail(f"helm registry login failed for {host}: {result.stderr.strip()}")
+    auths: dict[str, dict[str, str]] = {_NO_CREDENTIALS_HOST: {}}
+    if registry and sa_key_b64:
+        host = registry.split("/", 1)[0]
+        sa_key_json = base64.b64decode(sa_key_b64, validate=True).decode("utf-8")
+        token = base64.b64encode(f"_json_key:{sa_key_json}".encode()).decode()
+        auths[host] = {"auth": token}
+    with tempfile.TemporaryDirectory(prefix="ellf-helm-") as tmp:
+        path = Path(tmp) / "registry.json"
+        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        with os.fdopen(fd, "w") as f:
+            json.dump({"auths": auths}, f)
+        yield path
+
+
+def chart_source(
+    creds: ClusterCredentials, registry: Optional[str], sa_key_b64: Optional[str]
+) -> "tuple[str, ContextManager[Path]]":
+    """The chart to install and the helm registry config to pull it with.
+
+    PAM names a chart anyone can pull, which needs no credentials. A PAM
+    that predates the public chart repository names none: the chart is then
+    only in the upstream registry, behind the registry key.
+    """
+    if creds.image.chart:
+        return creds.image.chart, helm_registry_config()
+    if not registry:
+        msg.fail(
+            "registries.upstream (or legacy image.registry) is empty in values.yaml"
+        )
         raise SystemExit(1)
-    msg.info(f"Authenticated Helm to {host}")
+    return f"oci://{registry}/ellf", helm_registry_config(registry, sa_key_b64)
 
 
 def get_cluster_auth(

{ellf_cli-22.0.4 → ellf_cli-22.0.6}/ellf_cli/commands/infra/deploy.py

@@ -1,7 +1,7 @@
 import base64
 import json
+import secrets
 import subprocess
-import tempfile
 import time
 from pathlib import Path
 from typing import Optional
@@ -28,7 +28,7 @@ from ...key_pair import generate_key_pair
 from ...url import URL
 from .._state import get_auth_state
 from ._config_io import FILL_IN
-from ._helpers import create_image_pull_secret, ensure_traefik, helm_registry_login
+from ._helpers import chart_source, create_image_pull_secret, ensure_traefik
 from .tls import MANAGED_TLS_SECRET_NAME
 
 DEFAULT_NAMESPACE = "ellf"
@@ -102,12 +102,22 @@ def deploy(
         )
     overrides.image.broker_version = creds.image.broker_version
     overrides.image.cpl_version = creds.image.cpl_version
-    # The registry key is PAM's too: each org has its own, which PAM may
-    # replace (a leaked key is deleted and the org given a fresh one). The
-    # copy init-values saved in values.yaml goes stale when that happens,
-    # so always deploy the key PAM hands out now.
+    # The registry key and licence key are PAM's too, and are handed to the
+    # cluster straight from PAM on every deploy rather than kept in
+    # values.yaml: each org has its own registry key, which PAM may replace
+    # (a leaked key is deleted and the org given a fresh one), and keeping
+    # them in a file leaves them on the installer's disk.
+    stored = _secrets_in_values(values_dict)
+    if stored:
+        msg.warn(
+            f"{values_file} holds secrets ({', '.join(stored)}). Deploy no "
+            "longer needs them there: the registry and licence keys come from "
+            "PAM and the database password from the cluster. Delete them "
+            "from the file."
+        )
     if overrides.secrets is not None:
         overrides.secrets.container_sa_key = creds.secrets.container_sa_key
+        overrides.secrets.prodigy_license_key = creds.secrets.prodigy_license_key
     # 1. Create namespace
     msg.info(f"Ensuring namespace {namespace}...")
     subprocess.run(
@@ -159,17 +169,24 @@ def deploy(
     infra_secret_name = (
         overrides.secrets.infra_secret_name if overrides.secrets else None
     ) or ""
+    postgresql = overrides.postgresql
+    if postgresql and postgresql.enabled:
+        # The bundled database's password lives in the cluster, not in
+        # values.yaml: reuse the one it was installed with, or make one up
+        # on the first install. A new one on upgrade would lock the
+        # cluster out of its existing database.
+        if postgresql.auth is None:
+            postgresql.auth = HelmChartOverrides.Postgresql.Auth()
+        if not postgresql.auth.password:
+            postgresql.auth.password = _installed_database_password(
+                infra_secret_name, namespace
+            ) or secrets.token_urlsafe(24)
+        database_password = postgresql.auth.password
+    else:
+        database_password = (
+            overrides.secrets.database_password if overrides.secrets else None
+        ) or ""
     if infra_secret_name:
-        # Resolve the database password from postgresql subchart or explicit config.
-        postgresql = overrides.postgresql
-        if postgresql and postgresql.enabled:
-            database_password = (
-                postgresql.auth.password if postgresql.auth else None
-            ) or ""
-        else:
-            database_password = (
-                overrides.secrets.database_password if overrides.secrets else None
-            ) or ""
         public_key_pem = _ensure_cluster_keypair_standalone(
             infra_secret_name, namespace, database_password=database_password
         )
@@ -199,17 +216,16 @@ def deploy(
         _require_tls_secret(operator_tls_secret, namespace)
     # 7. Helm upgrade --install
     if chart is None:
-        # Use OCI chart from the registry
-        if not registry:
-            msg.fail(
-                "registries.upstream (or legacy image.registry) is empty in values.yaml"
-            )
-            raise SystemExit(1)
-        if container_sa_key:
-            helm_registry_login(registry, container_sa_key)
-        chart_ref = f"oci://{registry}/ellf"
+        chart_ref, registry_config = chart_source(creds, registry, container_sa_key)
         msg.info(f"Installing from {chart_ref}...")
-        upgrade_from_ref(chart_ref, overrides, namespace=namespace, wait=wait)
+        with registry_config as registry_config_path:
+            upgrade_from_ref(
+                chart_ref,
+                overrides,
+                namespace=namespace,
+                wait=wait,
+                registry_config=registry_config_path,
+            )
     else:
         msg.info(f"Installing from local chart {chart}...")
         upgrade(chart, overrides, namespace=namespace, wait=wait)
@@ -439,32 +455,85 @@ def _ensure_cluster_keypair_standalone(
 def _patch_secret_field(secret_name: str, namespace: str, key: str, value: str) -> None:
     """Ensure a single field exists in an existing K8s secret.
 
-    The patch body goes through ``--patch-file`` (a short-lived tempfile) so
-    the value never appears on the kubectl command line, where ``ps`` would
-    expose it.
+    The updated secret goes to kubectl on stdin, so the value appears neither
+    on the command line, where ``ps`` would expose it, nor in a file.
     """
-    patch = json.dumps({"stringData": {key: value}})
-    with tempfile.NamedTemporaryFile(
-        mode="w", suffix=".json", delete=True
-    ) as patch_file:
-        patch_file.write(patch)
-        patch_file.flush()
-        subprocess.run(
-            [
-                "kubectl",
-                "patch",
-                "secret",
-                secret_name,
-                f"--namespace={namespace}",
-                "--type",
-                "merge",
-                "--patch-file",
-                patch_file.name,
-            ],
-            check=True,
-            text=True,
-            capture_output=True,
+    current = subprocess.run(
+        [
+            "kubectl",
+            "get",
+            "secret",
+            secret_name,
+            f"--namespace={namespace}",
+            "-o",
+            "json",
+        ],
+        check=True,
+        text=True,
+        capture_output=True,
+    )
+    secret = json.loads(current.stdout)
+    secret.setdefault("data", {})[key] = base64.b64encode(value.encode()).decode()
+    subprocess.run(
+        ["kubectl", "replace", "-f", "-"],
+        input=json.dumps(secret),
+        check=True,
+        text=True,
+        capture_output=True,
+    )
+
+
+def _read_secret_field(secret_name: str, namespace: str, key: str) -> str:
+    """A field of a K8s secret, decoded; empty when the secret or field is missing."""
+    jsonpath_key = key.replace(".", r"\.")
+    result = subprocess.run(
+        [
+            "kubectl",
+            "get",
+            "secret",
+            secret_name,
+            f"--namespace={namespace}",
+            "-o",
+            f"jsonpath={{.data.{jsonpath_key}}}",
+        ],
+        text=True,
+        capture_output=True,
+    )
+    if result.returncode != 0 or not result.stdout.strip():
+        return ""
+    return base64.b64decode(result.stdout.strip()).decode("utf-8")
+
+
+def _installed_database_password(infra_secret_name: str, namespace: str) -> str:
+    """The bundled database's password, from an earlier install of the cluster.
+
+    Deploy keeps it in the infra secret. Clusters installed before that have
+    it only in the database chart's own secret. Empty on a first install.
+    """
+    if infra_secret_name:
+        password = _read_secret_field(
+            infra_secret_name, namespace, "ELLF_DATABASE_PASSWORD"
         )
+        if password:
+            return password
+    return _read_secret_field(f"{DEFAULT_RELEASE}-postgresql", namespace, "password")
+
+
+def _secrets_in_values(values: dict) -> list[str]:
+    """Dotted keys of the secrets a values.yaml still holds.
+
+    'infra init-values' used to write them there; deploy now takes them from
+    PAM and the cluster instead.
+    """
+    found = []
+    secrets_block = values.get("secrets") or {}
+    for key in ("containerSaKey", "prodigyLicenseKey"):
+        if secrets_block.get(key):
+            found.append(f"secrets.{key}")
+    postgresql_auth = (values.get("postgresql") or {}).get("auth") or {}
+    if postgresql_auth.get("password"):
+        found.append("postgresql.auth.password")
+    return found
 
 
 WORKER_TYPES_CONFIGMAP = "ellf-worker-types"