multicloud-cli 0.1.0__tar.gz → 0.3.0__tar.gz

multicloud_cli-0.1.0/README.md → multicloud_cli-0.3.0/PKG-INFO

@@ -1,3 +1,34 @@
+Metadata-Version: 2.5
+Name: multicloud-cli
+Version: 0.3.0
+Summary: mctl: the Multicloud command line: sign in, connect your cloud account, run pools
+Project-URL: Homepage, https://multicloud.io
+Author-email: Multicloud Team <info@multicloud.io>
+License: Apache-2.0
+License-File: LICENSE
+Keywords: aws,cli,cloud,kubernetes,multicloud
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.10
+Requires-Dist: click>=8.1
+Requires-Dist: keyring>=24
+Requires-Dist: requests>=2.31
+Provides-Extra: test
+Requires-Dist: pytest>=8; extra == 'test'
+Description-Content-Type: text/markdown
+
 # multicloud-cli
 
 `mctl` connects your AWS account to [Multicloud](https://multicloud.io).
@@ -5,13 +36,14 @@ Multicloud then starts machines in your account, and AWS bills you directly.
 You give Multicloud no password and no access key: you create one IAM role with the public
 Terraform module [multicloud/multicloud/aws](https://registry.terraform.io/modules/multicloud/multicloud/aws).
 
-The package is not on PyPI yet, so these commands do not work today. When it is published, install it with:
+Install it from PyPI (Python 3.10 or later):
 
 ```bash
 pipx install multicloud-cli        # or: uv tool install multicloud-cli
 ```
 
 If `mctl` is not found after the install, run `uv tool update-shell` (or `pipx ensurepath`) and open a new shell.
+Upgrade with `uv tool upgrade multicloud-cli` (or `pipx upgrade multicloud-cli`). Check the version with `mctl --version`.
 
 ## Connect an AWS account
 
@@ -22,6 +54,7 @@ OpenTofu or Terraform 1.5 or later.
 mctl auth login                       # opens your browser; sign in as you do on multicloud.io
 mkdir multicloud-aws && cd multicloud-aws
 mctl cloud-account create --cloud AWS --account 123456789012 --region us-east-1
+export AWS_REGION=us-east-1           # Terraform needs a region when your AWS profile has none
 mctl cloud-account apply 7            # init, plan, asks you, apply, then waits for "Ready"
 ```
 
@@ -46,10 +79,27 @@ mctl cloud-account verify 7 --wait
 | `mctl cloud-account token <id>` | A new one-time connect code, for a manual `terraform apply`. |
 | `mctl cloud-account verify <id> [--wait]` | Check the role again: `Ready` (exit 0), the missing permissions (exit 1) or pending (exit 5). |
 | `mctl cloud-account list` / `show <id> [--json]` | The connections of your team. |
+| `mctl overview` / `billing` | Setup checklist, alerts and pool counts; payment gate status. Read access or a member sign-in. |
+| `mctl extend create NAME` | Make an Extend pool. Owner sign-in only. |
+| `mctl peering create\|list\|show\|revoke POOL ...` | Manage the peerings of an Extend pool. Owner sign-in only. |
+| `mctl ssh allow\|list\|revoke`, `mctl node list`, `mctl ssh NODE [-y] [-- ssh args]` | Operators only (role `multicloud-admins`): open tcp/22 on a node for your own IPv4 address, list the nodes and the grants, connect. Details: `mctl ssh --help`. |
 
 The connect code reaches Terraform only through the environment of the `apply` process.
 `mctl` never prints a key or a token, and only `mctl cloud-account token` prints a connect code.
 
+## Overview, Extend pools and peerings
+
+```bash
+mctl overview                          # checklist, alerts, pools by status
+mctl billing                           # payment gate
+mctl extend create edge --max-servers 5
+mctl peering create edge --pods 20     # prints the install command for your cluster
+mctl peering show edge 4               # a READY peering also gives its bundle, once: save it
+mctl peering revoke edge 4
+```
+
+`extend` and `peering` need an SSO sign-in as an owner (`mctl auth login`); an API key gets 403.
+
 ## Sign in
 
 `mctl auth login` opens your browser on `auth.multicloud.io` (authorization code with PKCE, on a temporary
@@ -117,7 +167,7 @@ mctl catalog providers
 mctl catalog field-values                          # the values the filters accept
 ```
 
-Every command takes `--json`. See [docs/reference.md](docs/reference.md) for all options.
+Every command takes `--json`. `mctl catalog search -h` lists all filters.
 
 ## Use it from an AI agent
 
@@ -127,7 +177,8 @@ such as Claude Code to run these commands. The agent asks you before each apply
 ## More
 
 Every command shows its options with `--help` or `-h`, for example `mctl pool create -h`.
-The exit codes, shell completion and all options are in the [command reference](docs/reference.md):
-0 ok, 1 error, 2 usage, 3 sign-in or access, 4 not found, 5 still pending or wait timeout, 6 pool gone.
+Exit codes: 0 ok, 1 error, 2 usage, 3 sign-in or access, 4 not found, 5 still pending or wait timeout, 6 pool gone.
+
+Shell completion: `eval "$(_MCTL_COMPLETE=zsh_source mctl)"` in `~/.zshrc` (`bash_source` for bash).
 
 License: Apache-2.0.

multicloud_cli-0.1.0/PKG-INFO → multicloud_cli-0.3.0/README.md

@@ -1,18 +1,3 @@
-Metadata-Version: 2.5
-Name: multicloud-cli
-Version: 0.1.0
-Summary: mctl: sign in to Multicloud and connect your cloud account
-Author-email: Multicloud Team <info@multicloud.io>
-License: Apache-2.0
-License-File: LICENSE
-Requires-Python: >=3.10
-Requires-Dist: click>=8.1
-Requires-Dist: keyring>=24
-Requires-Dist: requests>=2.31
-Provides-Extra: test
-Requires-Dist: pytest>=8; extra == 'test'
-Description-Content-Type: text/markdown
-
 # multicloud-cli
 
 `mctl` connects your AWS account to [Multicloud](https://multicloud.io).
@@ -20,13 +5,14 @@ Multicloud then starts machines in your account, and AWS bills you directly.
 You give Multicloud no password and no access key: you create one IAM role with the public
 Terraform module [multicloud/multicloud/aws](https://registry.terraform.io/modules/multicloud/multicloud/aws).
 
-The package is not on PyPI yet, so these commands do not work today. When it is published, install it with:
+Install it from PyPI (Python 3.10 or later):
 
 ```bash
 pipx install multicloud-cli        # or: uv tool install multicloud-cli
 ```
 
 If `mctl` is not found after the install, run `uv tool update-shell` (or `pipx ensurepath`) and open a new shell.
+Upgrade with `uv tool upgrade multicloud-cli` (or `pipx upgrade multicloud-cli`). Check the version with `mctl --version`.
 
 ## Connect an AWS account
 
@@ -37,6 +23,7 @@ OpenTofu or Terraform 1.5 or later.
 mctl auth login                       # opens your browser; sign in as you do on multicloud.io
 mkdir multicloud-aws && cd multicloud-aws
 mctl cloud-account create --cloud AWS --account 123456789012 --region us-east-1
+export AWS_REGION=us-east-1           # Terraform needs a region when your AWS profile has none
 mctl cloud-account apply 7            # init, plan, asks you, apply, then waits for "Ready"
 ```
 
@@ -61,10 +48,27 @@ mctl cloud-account verify 7 --wait
 | `mctl cloud-account token <id>` | A new one-time connect code, for a manual `terraform apply`. |
 | `mctl cloud-account verify <id> [--wait]` | Check the role again: `Ready` (exit 0), the missing permissions (exit 1) or pending (exit 5). |
 | `mctl cloud-account list` / `show <id> [--json]` | The connections of your team. |
+| `mctl overview` / `billing` | Setup checklist, alerts and pool counts; payment gate status. Read access or a member sign-in. |
+| `mctl extend create NAME` | Make an Extend pool. Owner sign-in only. |
+| `mctl peering create\|list\|show\|revoke POOL ...` | Manage the peerings of an Extend pool. Owner sign-in only. |
+| `mctl ssh allow\|list\|revoke`, `mctl node list`, `mctl ssh NODE [-y] [-- ssh args]` | Operators only (role `multicloud-admins`): open tcp/22 on a node for your own IPv4 address, list the nodes and the grants, connect. Details: `mctl ssh --help`. |
 
 The connect code reaches Terraform only through the environment of the `apply` process.
 `mctl` never prints a key or a token, and only `mctl cloud-account token` prints a connect code.
 
+## Overview, Extend pools and peerings
+
+```bash
+mctl overview                          # checklist, alerts, pools by status
+mctl billing                           # payment gate
+mctl extend create edge --max-servers 5
+mctl peering create edge --pods 20     # prints the install command for your cluster
+mctl peering show edge 4               # a READY peering also gives its bundle, once: save it
+mctl peering revoke edge 4
+```
+
+`extend` and `peering` need an SSO sign-in as an owner (`mctl auth login`); an API key gets 403.
+
 ## Sign in
 
 `mctl auth login` opens your browser on `auth.multicloud.io` (authorization code with PKCE, on a temporary
@@ -132,7 +136,7 @@ mctl catalog providers
 mctl catalog field-values                          # the values the filters accept
 ```
 
-Every command takes `--json`. See [docs/reference.md](docs/reference.md) for all options.
+Every command takes `--json`. `mctl catalog search -h` lists all filters.
 
 ## Use it from an AI agent
 
@@ -142,7 +146,8 @@ such as Claude Code to run these commands. The agent asks you before each apply
 ## More
 
 Every command shows its options with `--help` or `-h`, for example `mctl pool create -h`.
-The exit codes, shell completion and all options are in the [command reference](docs/reference.md):
-0 ok, 1 error, 2 usage, 3 sign-in or access, 4 not found, 5 still pending or wait timeout, 6 pool gone.
+Exit codes: 0 ok, 1 error, 2 usage, 3 sign-in or access, 4 not found, 5 still pending or wait timeout, 6 pool gone.
+
+Shell completion: `eval "$(_MCTL_COMPLETE=zsh_source mctl)"` in `~/.zshrc` (`bash_source` for bash).
 
 License: Apache-2.0.

multicloud_cli-0.3.0/multicloud_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.0"

multicloud_cli-0.3.0/multicloud_cli/account.py

@@ -0,0 +1,86 @@
+"""``mctl overview`` and ``mctl billing``: the state of the organization.
+
+``overview`` calls ``GET /api/v1/orgs/{slug}/overview``, ``billing`` calls ``GET /api/v1/orgs/{slug}/billing``.
+Both need the ``org:read`` scope (``org:write`` and ``org:admin`` include it) or the SSO sign-in of any member.
+The API leaves out fields that have no value, so every key is optional here.
+"""
+from typing import Any, Dict
+
+import click
+
+from . import api, exitcodes
+from .output import dump as _dump, json_option, run
+
+READ = "org:read"
+
+
+class AccountError(exitcodes.CliError):
+    pass
+
+
+def _get(org, path: str) -> Dict[str, Any]:
+    try:
+        return api.call("GET", org, path, scope=READ)
+    except api.ApiError as ex:
+        raise AccountError(str(ex), ex.exit_code)
+
+
+def _org_option(f):
+    return click.option("--org", default=None, help="Organization slug (default: MULTICLOUD_ORG)")(f)
+
+
+def _checklist_line(item: Dict[str, Any]) -> str:
+    state = item.get("state")
+    notes = [n for n in ((state if state not in ("done", "open", None) else None),
+                          "optional" if item.get("optional") else None) if n]
+    return f"[{'x' if state == 'done' else ' '}] {item.get('step')}" + (f" ({', '.join(notes)})" if notes else "")
+
+
+def _alert_line(a: Dict[str, Any]) -> str:
+    line = str(a.get("kind"))
+    if a.get("pool_id") is not None or a.get("name"):
+        line += f": pool {a.get('pool_id') if a.get('pool_id') is not None else '?'}" + (f" ({a['name']})" if a.get("name") else "")
+    return line
+
+
+def readable_overview(data: Dict[str, Any]) -> str:
+    lines = ["Checklist:"] + [_checklist_line(i) for i in data.get("checklist") or []]
+    alerts = data.get("alerts") or []
+    lines.append("Alerts:" + ("" if alerts else " none"))
+    lines += [f"  {_alert_line(a)}" for a in alerts]
+    pools = data.get("pools") or {}
+    lines.append(f"Pools: {pools.get('total', 0)}")
+    lines += [f"  {status}: {n}" for status, n in sorted((pools.get("by_status") or {}).items())]
+    return "\n".join(lines)
+
+
+def readable_billing(data: Dict[str, Any]) -> str:
+    gate = data.get("payment_gate") or {}
+    lines = [f"Payment gate: {gate.get('status', 'unknown')}"]
+    for key, label in (("passed_at", "Passed"), ("waived_at", "Waived"),
+                       ("waiver_expires_at", "Waiver expires"), ("suspended_at", "Suspended")):
+        if gate.get(key):
+            lines.append(f"{label}: {gate[key]}")
+    return "\n".join(lines)
+
+
+@click.command()
+@_org_option
+@json_option
+def overview(org, as_json):
+    """Show the setup checklist, alerts and pool counts of the organization."""
+    data = run(org, lambda o: _get(o, "/overview"), (AccountError, api.ApiError))
+    if as_json:
+        return _dump(data)
+    click.echo(readable_overview(data))
+
+
+@click.command()
+@_org_option
+@json_option
+def billing(org, as_json):
+    """Show the payment gate of the organization and its dates."""
+    data = run(org, lambda o: _get(o, "/billing"), (AccountError, api.ApiError))
+    if as_json:
+        return _dump(data)
+    click.echo(readable_billing(data))

{multicloud_cli-0.1.0 → multicloud_cli-0.3.0}/multicloud_cli/api.py

@@ -11,7 +11,7 @@ from urllib.parse import quote
 
 import requests
 
-from . import auth, config, exitcodes, sso
+from . import auth, config, exitcodes, net, sso
 
 TIMEOUT_S = 30
 
@@ -52,12 +52,12 @@ def _detail_text(data: Any) -> Optional[str]:
 
 
 def _send(method: str, url: str, body: Optional[Dict[str, Any]], headers: Dict[str, str],
-          params: Optional[Dict[str, Any]] = None) -> requests.Response:
+          params: Optional[Dict[str, Any]] = None, ipv4_only: bool = False) -> requests.Response:
     extra = {"params": params} if params else {}  # a list value becomes one repeated key
     try:
         # No redirects: requests would carry the credential header to another host.
-        return requests.request(method, url, json=body, timeout=TIMEOUT_S, allow_redirects=False, headers=headers,
-                                **extra)
+        return net.request(method, url, json=body, timeout=TIMEOUT_S, allow_redirects=False, headers=headers,
+                           ipv4_only=ipv4_only, **extra)
     except requests.RequestException as ex:
         raise ApiError(f"Could not reach the API: {ex}")
 
@@ -84,24 +84,31 @@ def _sso_org(slug: Optional[str], token: str, explicit: bool = True) -> str:
 def call(method: str, org: Optional[str], path: str = "", *, body: Optional[Dict[str, Any]] = None,
          headers: Optional[Dict[str, str]] = None, accept: Iterable[int] = (200, 201, 202),
          scope: Optional[str] = None, pass_codes: Iterable[str] = (),
-         params: Optional[Dict[str, Any]] = None, org_scoped: bool = True) -> Dict[str, Any]:
+         params: Optional[Dict[str, Any]] = None, org_scoped: bool = True,
+         ipv4_only: bool = False, prefer_sso: bool = False) -> Dict[str, Any]:
     """One API call. Returns the JSON body with ``_status`` added; raises ``ApiError`` on other statuses.
 
     ``scope`` names the API key scope this call needs; a 401 or 403 then says that it may be missing.
     A failed answer whose error code is in ``pass_codes`` is returned like a success.
     ``params`` are query parameters. ``org_scoped=False`` calls ``/api/v1{path}`` with no organization in the URL:
     an SSO call then needs no organization, and ``MULTICLOUD_API_KEY`` needs none either (a stored key still
-    needs one to be found)."""
+    needs one to be found). ``ipv4_only`` connects over IPv4 only (the SSH grant routes). ``prefer_sso`` keeps the
+    SSO token on a platform route even when the named org has a stored key or ``MULTICLOUD_API_KEY`` is set: the
+    operator routes check a realm role,
+    which an API key never holds."""
     slug = config.get_org(org)
     try:
         use_sso = False
-        if not os.environ.get("MULTICLOUD_API_KEY"):  # the key path needs no issuer
+        if prefer_sso or not os.environ.get("MULTICLOUD_API_KEY"):  # the key path needs no issuer
             issuer = config.get_issuer()
             use_sso = auth.load_sso(issuer) is not None
-            if use_sso and not org_scoped and slug and auth.get_key(slug)[0]:
+            if use_sso and not org_scoped and not prefer_sso and slug and auth.get_key(slug)[0]:
                 # A stored key of the named org wins for the platform routes (the catalog): it holds its scope
                 # explicitly, while an SSO token may not reach them.
                 use_sso = False
+            if prefer_sso and not use_sso:
+                raise ApiError("This command needs an SSO sign-in; an API key never reaches it. Run: mctl auth login",
+                               exit_code=exitcodes.AUTH)
         base = config.get_api_url()
         if use_sso:
             token = auth.fresh_access_token(issuer)
@@ -124,14 +131,15 @@ def call(method: str, org: Optional[str], path: str = "", *, body: Optional[Dict
     except config.ConfigError as ex:
         raise ApiError(str(ex))
     url = f"{base}/api/v1/orgs/{quote(slug, safe='')}{path}" if org_scoped else f"{base}/api/v1{path}"
-    r = _send(method, url, body, {**credential, **(headers or {})}, params)
+    r = _send(method, url, body, {**credential, **(headers or {})}, params, ipv4_only)
     if r.status_code == 401 and use_sso:
         # The access token was refused (the session may have ended on the server): refresh once and retry once.
         try:
             token = auth.fresh_access_token(issuer, rejected=token)
         except auth.AuthError as ex:
             raise ApiError(str(ex), 401)
-        r = _send(method, url, body, {"Authorization": f"Bearer {token}", **(headers or {})}, params)
+        r = _send(method, url, body, {"Authorization": f"Bearer {token}", **(headers or {})}, params,
+                  ipv4_only)
     try:
         data = r.json() if r.text else {}
     except ValueError:

{multicloud_cli-0.1.0 → multicloud_cli-0.3.0}/multicloud_cli/auth.py

@@ -16,7 +16,7 @@ from urllib.parse import quote, urlparse
 import click
 import requests
 
-from . import config, exitcodes, sso
+from . import config, exitcodes, net, sso
 
 try:
     import fcntl
@@ -280,8 +280,8 @@ def check_key(org: str, api_url: str, key: str) -> Tuple[bool, str]:
     """GET the list of cloud accounts with this key. Returns (ok, error text)."""
     url = f"{api_url}/api/v1/orgs/{quote(org, safe='')}/cloud-accounts"
     try:
-        r = requests.request("GET", url, timeout=TIMEOUT_S, headers={"X-API-Key": key},
-                             allow_redirects=False)
+        r = net.request("GET", url, timeout=TIMEOUT_S, headers={"X-API-Key": key},
+                        allow_redirects=False)
     except requests.RequestException as ex:
         return False, f"Could not reach the API: {type(ex).__name__}"
     if r.status_code == 200:
@@ -369,8 +369,8 @@ def _probe(url: str, access: str, org: Optional[str]) -> Optional[int]:
     if not org:
         return None
     try:
-        r = requests.request("GET", f"{url}/api/v1/orgs/{quote(org, safe='')}/pool-classes", timeout=TIMEOUT_S,
-                             headers={"Authorization": f"Bearer {access}"}, allow_redirects=False)
+        r = net.request("GET", f"{url}/api/v1/orgs/{quote(org, safe='')}/pool-classes", timeout=TIMEOUT_S,
+                        headers={"Authorization": f"Bearer {access}"}, allow_redirects=False)
     except requests.RequestException:
         return None
     return r.status_code

{multicloud_cli-0.1.0 → multicloud_cli-0.3.0}/multicloud_cli/catalog.py

@@ -13,7 +13,7 @@ import click
 
 from . import api, exitcodes
 from .orgopt import org_group
-from .output import dump as _dump, json_option, no_headers_option, plain as _plain, quiet_option, run, table as _table
+from .output import dump as _dump, echo as _echo, json_option, no_headers_option, plain as _plain, quiet_option, run, table as _table
 
 SCOPE = "catalog"
 
@@ -243,7 +243,7 @@ def compare(ctx, catalog_ids, as_json, no_headers):
             cells.append(_number(found[0]) if found else "-")
         rows.append((str(metric), *cells))
     if servers:
-        click.echo(_table(header, rows, not no_headers))
+        _echo(_table(header, rows, not no_headers))
     meta = data.get("metadata") or {}
     for key, text in (("notFoundIds", "Not found"), ("invalidIds", "Invalid")):
         if meta.get(key):
@@ -278,7 +278,7 @@ def locations(ctx, provider, region, zone, sort_by, sort_order, page, per_page,
             if loc.get("id") is not None:
                 click.echo(loc["id"])
         return
-    click.echo(_table(("ID", "PROVIDER", "REGION", "ZONE", "NAME"), [
+    _echo(_table(("ID", "PROVIDER", "REGION", "ZONE", "NAME"), [
         (str(loc.get("id")), str(loc.get("provider") or "-"), str(loc.get("region") or "-"),
          str(loc.get("zone") or "-"), str(loc.get("display_name") or "-")) for loc in data.get("data", [])],
         not no_headers))

multicloud_cli-0.3.0/multicloud_cli/extend.py

@@ -0,0 +1,218 @@
+"""``mctl extend`` and ``mctl peering``: Extend pools and their peerings.
+
+These commands call ``/api/v1/orgs/{slug}/extend-pools`` and ``/api/v1/orgs/{slug}/pools/{name}/peerings``.
+The owner routes accept only the SSO sign-in of an owner of the organization (``mctl auth login``): an API key of
+any kind gets 403. Creating a pool or a peering goes through the payment gate and can answer 402 or 503.
+Neither request body holds a secret, so every field has a flag. ``--from-file`` still gives the full body.
+"""
+import json
+import sys
+import uuid
+from typing import Any, Dict, Optional
+from urllib.parse import quote
+
+import click
+
+from . import api, exitcodes
+from .orgopt import org_group
+from .output import (collect as _collect, dump as _dump, echo as _echo, json_option, load_body, no_headers_option, quiet_option,
+                     run, table as _table)
+from .pool import _status
+
+OWNER_HINT = "These commands need an SSO sign-in as an owner: run mctl auth login."
+GROUPS = {"extend": "extend_org", "peering": "peering_org"}
+
+
+class ExtendError(exitcodes.CliError):
+    pass
+
+
+def _stdin_is_tty() -> bool:
+    return sys.stdin.isatty()
+
+
+def _fail(ex: api.ApiError, text: Optional[str] = None) -> ExtendError:
+    text = text or str(ex)
+    if ex.status == 403:
+        text += " " + OWNER_HINT
+    return ExtendError(text, ex.exit_code)
+
+
+def _call(org, method: str, path: str, **kw) -> Dict[str, Any]:
+    # No scope: no API key can use these routes, so "the key may lack a scope" would mislead.
+    try:
+        return api.call(method, org, path, **kw)
+    except api.ApiError as ex:
+        raise _fail(ex)
+
+
+def _pool_path(pool: str, rest: str = "") -> str:
+    return f"/pools/{quote(pool, safe='')}/peerings{rest}"
+
+
+def _group(name: str, help_text: str):
+    @click.group(name=name, cls=org_group(GROUPS[name]), help=help_text)
+    @click.option("--org", default=None, help="Organization slug (default: MULTICLOUD_ORG)")
+    @click.pass_context
+    def g(ctx, org):
+        ctx.ensure_object(dict)
+        ctx.obj[GROUPS[name]] = org
+    return g
+
+
+extend = _group("extend", "Create Extend pools (owner sign-in: mctl auth login).")
+peering = _group("peering", "Manage peerings of an Extend pool (owner sign-in: mctl auth login).")
+
+
+def _run(ctx, key, fn):
+    return run(ctx.obj.get(key), fn, (ExtendError, api.ApiError))
+
+
+@extend.command(name="create")
+@click.argument("name", required=False)
+@click.option("--max-servers", type=int, default=None, help="Most servers the pool may hold (1-50)")
+@click.option("--max-cost-per-hour", type=float, default=None, help="Cost ceiling in USD per hour (up to 50)")
+@click.option("--from-file", "from_file", type=click.Path(dir_okay=False, allow_dash=True), default=None,
+              help="JSON file with the request body (- for standard input); flags override its fields")
+@click.option("--idempotency-key", default=None,
+              help="Same key and body within 24 hours creates one pool (default: a new random key)")
+@json_option
+@click.pass_context
+def create_pool(ctx, name, max_servers, max_cost_per_hour, from_file, idempotency_key, as_json):
+    """Create an Extend pool."""
+    body = load_body(from_file)
+    body.update(_collect(name=name, max_servers=max_servers, max_cost_per_hour=max_cost_per_hour))
+    if "name" not in body:
+        raise click.UsageError("Missing: NAME")
+    key = idempotency_key or str(uuid.uuid4())
+
+    def go(org):
+        try:
+            return api.call("POST", org, "/extend-pools", body=body, headers={"Idempotency-Key": key})
+        except api.ApiError as ex:
+            if ex.status is None or ex.status >= 500:
+                # The pool may exist already: the same key and body make the retry safe.
+                raise _fail(ex, f"{ex} To retry safely, run the same command with --idempotency-key {key}")
+            raise _fail(ex)
+    made = _run(ctx, "extend_org", go)
+    if as_json:
+        return _dump(made)
+    click.echo(f"Pool {made.get('pool_id')} ({made.get('name')}) created. Status: {_status(made)}")
+    click.echo(f"Next: mctl peering create {made.get('name')}")
+
+
+GRANT_OPTIONS = (("cpu_millicores", "CPU the peering may use, in millicores (100-1000000)"),
+                 ("memory_mb", "Memory in MB (128-4000000)"),
+                 ("pods", "Number of pods (1-10000)"),
+                 ("ephemeral_storage_mb", "Ephemeral storage in MB (1024-10000000)"))
+
+
+def _grant_options(f):
+    for field, text in reversed(GRANT_OPTIONS):
+        f = click.option("--" + field.replace("_", "-"), field, type=int, default=None, help=text)(f)
+    return f
+
+
+def _peering_readable(p: Dict[str, Any]) -> str:
+    status = str(p.get("status"))
+    if p.get("reason"):
+        status += f" ({p['reason']})"
+    lines = [f"Peering {p.get('id')}", ("Consumer cluster", p.get("consumer_cluster_id")), f"Status: {status}",
+             ("Message", p.get("message")), ("Install command", p.get("helm_command"))]
+    out = "\n".join(l if isinstance(l, str) else f"{l[0]}: {l[1]}"
+                    for l in lines if isinstance(l, str) or l[1] not in (None, ""))
+    if p.get("bundle") is not None:
+        bundle = p["bundle"]
+        out += "\nBundle:\n" + (bundle if isinstance(bundle, str) else json.dumps(bundle, indent=2, sort_keys=True))
+    return out
+
+
+@peering.command(name="create")
+@click.argument("pool", metavar="POOL")
+@_grant_options
+@click.option("--from-file", "from_file", type=click.Path(dir_okay=False, allow_dash=True), default=None,
+              help="JSON file with the request body (- for standard input); flags override its fields")
+@json_option
+@click.pass_context
+def create_peering(ctx, pool, from_file, as_json, **grant):
+    """Create a peering for an Extend pool (name). Optional options ask for a resource grant."""
+    body = load_body(from_file)
+    body.update(_collect(**grant))
+
+    def go(org):
+        try:
+            return api.call("POST", org, _pool_path(pool), body=body)
+        except api.ApiError as ex:
+            if ex.status is None or ex.status >= 500:
+                # The route takes no Idempotency-Key: the peering may exist already.
+                raise _fail(ex, f"{ex} The peering may exist already. Check with: mctl peering list {pool}")
+            raise _fail(ex)
+    made = _run(ctx, "peering_org", go)
+    if as_json:
+        return _dump(made)
+    click.echo(f"Peering {made.get('id')} created. Status: {made.get('status')}")
+    if made.get("helm_command"):
+        click.echo(f"Install command: {made['helm_command']}")
+    click.echo(f"Next: mctl peering show {pool} {made.get('id')}")
+
+
+@peering.command(name="list")
+@click.argument("pool", metavar="POOL")
+@json_option
+@quiet_option
+@no_headers_option
+@click.pass_context
+def list_peerings(ctx, pool, as_json, quiet, no_headers):
+    """List the peerings of an Extend pool (name)."""
+    data = _run(ctx, "peering_org", lambda org: _call(org, "GET", _pool_path(pool)))
+    if as_json:
+        return _dump(data)
+    peerings = data.get("peerings") or []
+    if quiet:
+        for p in peerings:
+            click.echo(p.get("id"))
+        return
+    _echo(_table(("ID", "CONSUMER", "STATUS", "MESSAGE"), [
+        (str(p.get("id")), str(p.get("consumer_cluster_id") or "-"), str(p.get("status")),
+         str(p.get("message") or p.get("reason") or "-")) for p in peerings], not no_headers))
+
+
+@peering.command(name="show")
+@click.argument("pool", metavar="POOL")
+@click.argument("peering_id", metavar="ID", type=click.IntRange(min=1))
+@json_option
+@click.pass_context
+def show(ctx, pool, peering_id, as_json):
+    """Show one peering. The first read of a READY peering also gives its bundle, once: save it."""
+    data = _run(ctx, "peering_org", lambda org: _call(org, "GET", _pool_path(pool, f"/{peering_id}")))
+    if data.get("bundle") is not None:
+        click.echo("The bundle is shown only once. Save it now.", err=True)
+    if as_json:
+        return _dump(data)
+    click.echo(_peering_readable(data))
+
+
+@peering.command(name="revoke")
+@click.argument("pool", metavar="POOL")
+@click.argument("peering_id", metavar="ID", type=click.IntRange(min=1))
+@click.option("-y", "--yes", is_flag=True, help="Revoke without asking")
+@json_option
+@click.pass_context
+def revoke(ctx, pool, peering_id, yes, as_json):
+    """Revoke a peering. The consumer cluster loses access."""
+    if not yes and not _stdin_is_tty():
+        click.echo("Error: Refusing to revoke without confirmation. Run again with --yes.", err=True)
+        sys.exit(exitcodes.ERROR)
+
+    def go(org):
+        if not yes and not click.confirm(
+                f"This revokes peering {peering_id} of pool {pool}. The consumer cluster loses access. Revoke it?",
+                default=False):
+            click.echo("Nothing revoked.", err=True)
+            return exitcodes.ERROR
+        data = _call(org, "DELETE", _pool_path(pool, f"/{peering_id}"))
+        click.echo("Revoke started.", err=True)
+        if as_json:
+            _dump(data)
+        return exitcodes.OK
+    sys.exit(_run(ctx, "peering_org", go))

{multicloud_cli-0.1.0 → multicloud_cli-0.3.0}/multicloud_cli/main.py

@@ -5,10 +5,14 @@ import sys
 import click
 
 from . import __version__, exitcodes
+from .account import billing, overview
 from .auth import auth
 from .catalog import catalog
 from .cloud_account import cloud_account
+from .extend import extend, peering
+from .node import node
 from .pool import pool
+from .ssh import ssh
 
 
 def _broken_pipe() -> int:
@@ -49,6 +53,12 @@ mctl.add_command(auth)
 mctl.add_command(cloud_account)
 mctl.add_command(pool)
 mctl.add_command(catalog)
+mctl.add_command(overview)
+mctl.add_command(billing)
+mctl.add_command(extend)
+mctl.add_command(peering)
+mctl.add_command(ssh)
+mctl.add_command(node)
 
 
 def _run() -> int: