truefoundry 0.7.0rc3__tar.gz → 0.7.0rc5__tar.gz

{truefoundry-0.7.0rc3 → truefoundry-0.7.0rc5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: truefoundry
-Version: 0.7.0rc3
+Version: 0.7.0rc5
 Summary: TrueFoundry CLI
 Author-email: TrueFoundry Team <abhishek@truefoundry.com>
 Requires-Python: <3.14,>=3.8.1

{truefoundry-0.7.0rc3 → truefoundry-0.7.0rc5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "truefoundry"
-version = "0.7.0rc3"  # This is a placeholder version, it will be replaced when releasing
+version = "0.7.0rc5"  # This is a placeholder version, it will be replaced when releasing
 requires-python = ">=3.8.1,<3.14"
 description = "TrueFoundry CLI"
 authors = [{ name = "TrueFoundry Team", email = "abhishek@truefoundry.com" }]

{truefoundry-0.7.0rc3 → truefoundry-0.7.0rc5}/truefoundry/cli/__main__.py

@@ -14,6 +14,7 @@ from truefoundry.deploy.cli.commands import (
     get_delete_command,
     get_deploy_command,
     get_deploy_init_command,
+    get_get_command,
     get_login_command,
     get_logout_command,
     get_patch_application_command,
@@ -88,6 +89,7 @@ def create_truefoundry_cli() -> click.Group:
     cli.add_command(get_trigger_command())
     cli.add_command(get_terminate_command())
     cli.add_command(get_ml_cli())
+    cli.add_command(get_get_command())
 
     if not (sys.platform.startswith("win32") or sys.platform.startswith("cygwin")):
         cli.add_command(get_patch_command())

{truefoundry-0.7.0rc3 → truefoundry-0.7.0rc5}/truefoundry/common/entities.py

@@ -58,10 +58,14 @@ class Token(BaseModel):
         assert self.decoded_value is not None
         return self.decoded_value["tenantName"]
 
+    @property
+    def exp(self) -> int:
+        assert self.decoded_value is not None
+        return self.decoded_value["exp"]
+
     def is_going_to_be_expired(self, buffer_in_seconds: int = 120) -> bool:
         assert self.decoded_value is not None
-        exp = int(self.decoded_value["exp"])
-        return (exp - time.time()) < buffer_in_seconds
+        return (self.exp - time.time()) < buffer_in_seconds
 
     def to_user_info(self) -> UserInfo:
         assert self.decoded_value is not None

{truefoundry-0.7.0rc3 → truefoundry-0.7.0rc5}/truefoundry/common/session.py

@@ -8,7 +8,7 @@ from truefoundry.common.credential_provider import (
     EnvCredentialProvider,
     FileCredentialProvider,
 )
-from truefoundry.common.entities import UserInfo
+from truefoundry.common.entities import Token, UserInfo
 from truefoundry.common.utils import relogin_error_message
 from truefoundry.logger import logger
 
@@ -20,7 +20,7 @@ class Session:
     def __init__(self) -> None:
         self._closed = False
         self._cred_provider: Optional[CredentialProvider] = self._get_cred_provider()
-        self._user_info: Optional[UserInfo] = self._cred_provider.token.to_user_info()
+        self._user_info: Optional[UserInfo] = self.token.to_user_info()
 
     @staticmethod
     def _get_cred_provider() -> CredentialProvider:
@@ -69,7 +69,12 @@ class Session:
     @property
     def access_token(self) -> str:
         assert self._cred_provider is not None
-        return self._cred_provider.token.access_token
+        return self.token.access_token
+
+    @property
+    def token(self) -> Token:
+        assert self._cred_provider is not None
+        return self._cred_provider.token
 
     @property
     def tfy_host(self) -> str:

truefoundry-0.7.0rc5/truefoundry/deploy/cli/commands/get_command.py

@@ -0,0 +1,30 @@
+import rich_click as click
+
+from truefoundry.cli.const import GROUP_CLS
+from truefoundry.common.utils import is_internal_env_set
+from truefoundry.deploy.cli.commands.k8s_exec_credential_command import (
+    k8s_exec_credential_command,
+)
+from truefoundry.deploy.cli.commands.kubeconfig_command import kubeconfig_command
+
+# TODO (chiragjn): --json should disable all non json console prints
+
+
+@click.group(name="get", cls=GROUP_CLS)
+def get_command():
+    # TODO (chiragjn): Figure out a way to update supported resources based on ENABLE_* flags
+    """
+    Get TrueFoundry resources
+
+    \b
+    Supported resources:
+    - Kubeconfig
+    """
+    pass
+
+
+def get_get_command():
+    get_command.add_command(kubeconfig_command)
+    if is_internal_env_set():
+        get_command.add_command(k8s_exec_credential_command)
+    return get_command

truefoundry-0.7.0rc5/truefoundry/deploy/cli/commands/k8s_exec_credential_command.py

@@ -0,0 +1,64 @@
+import json
+from datetime import datetime, timezone
+from typing import Any, Dict, Optional
+from urllib.parse import urlparse
+
+import rich_click as click
+
+from truefoundry.cli.const import COMMAND_CLS
+from truefoundry.cli.util import handle_exception_wrapper
+from truefoundry.common.session import Session
+from truefoundry.deploy.cli.commands.utils import (
+    CONTEXT_NAME_FORMAT,
+    get_cluster_server_url,
+    get_kubeconfig_content,
+    get_kubeconfig_path,
+)
+from truefoundry.deploy.io.no_output_callback import NoOutputCallBack
+from truefoundry.deploy.lib.session import login
+
+
+@click.command(
+    name="k8s-exec-credential",
+    cls=COMMAND_CLS,
+    help="Generate a Kubernetes exec credential for the specified cluster user",
+)
+@click.option(
+    "-c",
+    "--cluster",
+    type=str,
+    required=True,
+    help="The cluster id from TrueFoundry",
+)
+@handle_exception_wrapper
+def k8s_exec_credential_command(cluster: str) -> None:
+    """
+    Generate a Kubernetes exec credential for the specified cluster.
+    This command retrieves the cluster server URL from the kubeconfig file,
+    """
+    path = get_kubeconfig_path()
+    kubeconfig: Dict[str, Any] = get_kubeconfig_content(path=path)
+    server_url: Optional[str] = get_cluster_server_url(kubeconfig, cluster)
+    if not server_url:
+        raise click.ClickException(
+            f"\nContext {CONTEXT_NAME_FORMAT.format(cluster=cluster)!r} for cluster {cluster!r} not found in kubeconfig. \n\nPlease run 'tfy get kubeconfig --cluster {cluster}' first."
+        )
+    host: str = f"{urlparse(server_url).scheme}://{urlparse(server_url).netloc}"
+    login(host=host, output_hook=NoOutputCallBack())
+
+    session = Session.new()
+    token: str = session.access_token
+
+    exec_credential: Dict[str, Any] = {
+        "kind": "ExecCredential",
+        "apiVersion": "client.authentication.k8s.io/v1beta1",
+        "spec": {},
+        "status": {
+            "expirationTimestamp": datetime.fromtimestamp(
+                session.token.exp, tz=timezone.utc
+            ).strftime("%Y-%m-%dT%H:%M:%SZ"),
+            "token": token,
+        },
+    }
+
+    print(json.dumps(exec_credential, indent=4))

truefoundry-0.7.0rc5/truefoundry/deploy/cli/commands/kubeconfig_command.py

@@ -0,0 +1,129 @@
+from typing import Any, Dict, Optional
+from urllib.parse import urljoin
+
+import questionary
+import rich_click as click
+from rich.console import Console
+
+from truefoundry.cli.const import COMMAND_CLS
+from truefoundry.cli.util import handle_exception_wrapper
+from truefoundry.common.session import Session
+from truefoundry.deploy.cli.commands.utils import (
+    CONTEXT_NAME_FORMAT,
+    add_update_cluster_context,
+    get_cluster_server_url,
+    get_kubeconfig_content,
+    get_kubeconfig_path,
+    save_kubeconfig,
+)
+
+console = Console()
+
+
+def _select_cluster(cluster: Optional[str] = None) -> str:
+    """
+    Retrieve available clusters and either return the specified one after validation
+    or allow the user to interactively select from the list.
+    """
+    from truefoundry.deploy.lib.clients.servicefoundry_client import (
+        ServiceFoundryServiceClient,
+    )
+
+    clusters = ServiceFoundryServiceClient().list_clusters()
+
+    if not clusters:
+        raise click.ClickException("No clusters found in your account.")
+
+    if cluster:
+        if not any(c.id == cluster for c in clusters):
+            raise click.ClickException(
+                f"Cluster {cluster} not found. Either it does not exist or you might not be autthorized to access it"
+            )
+        return cluster
+
+    choices = {cluster.id: cluster for cluster in clusters}
+    cluster = questionary.select(
+        "Available Clusters:", choices=list(choices.keys())
+    ).ask()
+    if not cluster:
+        raise click.ClickException("No cluster selected.")
+    return cluster
+
+
+def _construct_k8s_proxy_server(host: str, cluster: str) -> str:
+    """
+    Construct the Kubernetes proxy server URL.
+    """
+    return urljoin(host, f"api/svc/v1/k8s/proxy/{cluster}")
+
+
+def _should_update_existing_context(cluster: str, kubeconfig: Dict[str, Any]) -> bool:
+    """
+    Prompt the user whether to overwrite an existing kubeconfig context.
+    """
+    server_url = get_cluster_server_url(kubeconfig, cluster)
+    if server_url is not None:
+        console.print(
+            f"\nContext {CONTEXT_NAME_FORMAT.format(cluster=cluster)!r} for cluster {cluster!r} already exists in kubeconfig.\n"
+        )
+        return click.confirm(
+            text="Do you want to update the context?", default=False, err=True
+        )
+    return True
+
+
+@click.command(name="kubeconfig", cls=COMMAND_CLS)
+@click.option(
+    "-c",
+    "--cluster",
+    type=str,
+    required=False,
+    help="The cluster id from TrueFoundry. If not provided, an interactive prompt will list available clusters",
+)
+@click.option(
+    "--overwrite",
+    is_flag=True,
+    default=False,
+    show_default=True,
+    help="Overwrites existing cluster entry without prompting",
+)
+@handle_exception_wrapper
+def kubeconfig_command(cluster: Optional[str] = None, overwrite: bool = False) -> None:
+    """
+    Update kubeconfig file to access cluster attached to TrueFoundry Control Plane.
+
+    By default, credentials are written to ~/.kube/config. You can provide an alternate path by setting the KUBECONFIG environment variable. If KUBECONFIG contains multiple paths, the first one is used.
+    """
+    session = Session.new()
+    cluster = _select_cluster(cluster)
+
+    path = get_kubeconfig_path()
+    kubeconfig = get_kubeconfig_content(path=path)
+
+    if not overwrite and not _should_update_existing_context(cluster, kubeconfig):
+        console.print(
+            "Existing context found. Use '--overwrite' to force update the context."
+        )
+        return
+
+    k8s_proxy_server = _construct_k8s_proxy_server(session.tfy_host, cluster)
+    context_name = add_update_cluster_context(
+        kubeconfig,
+        cluster,
+        k8s_proxy_server,
+        exec_command=[
+            "tfy",
+            "--json",
+            "get",
+            "k8s-exec-credential",
+            "--cluster",
+            cluster,
+        ],
+        envs={"TFY_INTERNAL": "1"},
+    )
+
+    save_kubeconfig(kubeconfig, path=path)
+    console.print(
+        f"\nUpdated kubeconfig at {str(path)!r} with context {context_name!r} for cluster {cluster!r}\n\n"
+        f"Run 'kubectl config use-context {context_name}' to use this context.\n"
+    )

truefoundry-0.7.0rc5/truefoundry/deploy/cli/commands/utils.py

@@ -0,0 +1,118 @@
+import os
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+import yaml
+
+DEFAULT_KUBECONFIG_PATH: Path = Path.home() / ".kube" / "config"
+CLUSTER_NAME_FORMAT: str = "tfy-{cluster}-cluster"
+USER_NAME_FORMAT: str = "tfy-{cluster}-user"
+CONTEXT_NAME_FORMAT: str = "tfy-{cluster}-context"
+KUBE_CONFIG_CONTENT = {
+    "apiVersion": "v1",
+    "kind": "Config",
+    "clusters": [],
+    "users": [],
+    "contexts": [],
+}
+
+
+def get_kubeconfig_path() -> Path:
+    """
+    Returns the kubeconfig path to use.
+    If KUBECONFIG is set, returns the first path from the environment variable.
+    Otherwise, returns the default kubeconfig path.
+    """
+    kubeconfig_env = os.environ.get("KUBECONFIG")
+    if kubeconfig_env:
+        # Use the first path in KUBECONFIG if multiple are provided
+        first_path = kubeconfig_env.split(os.pathsep)[0]
+        return Path(first_path)
+    return DEFAULT_KUBECONFIG_PATH
+
+
+def get_kubeconfig_content(path: Path = DEFAULT_KUBECONFIG_PATH) -> Dict[str, Any]:
+    if path.exists():
+        with open(path, "r") as f:
+            return yaml.safe_load(f) or KUBE_CONFIG_CONTENT
+    else:
+        return KUBE_CONFIG_CONTENT
+
+
+def save_kubeconfig(config: Dict[str, Any], path: Path) -> None:
+    config["apiVersion"] = "v1"
+    config["kind"] = "Config"
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with open(path, "w") as f:
+        yaml.safe_dump(config, f, default_flow_style=False)
+
+
+def add_update_cluster_context(
+    config: Dict[str, Any],
+    cluster: str,
+    server_url: str,
+    exec_command: List[str],
+    envs: Optional[Dict[str, str]] = None,
+) -> str:
+    """
+    Adds a new cluster context to the given kubeconfig dictionary using exec-based authentication.
+    """
+    cluster_name: str = CLUSTER_NAME_FORMAT.format(cluster=cluster)
+    user_name: str = USER_NAME_FORMAT.format(cluster=cluster)
+    context_name: str = CONTEXT_NAME_FORMAT.format(cluster=cluster)
+
+    # Add or update cluster
+    config["clusters"] = [
+        c for c in config.get("clusters", []) if c["name"] != cluster_name
+    ]
+    config["clusters"].append(
+        {
+            "name": cluster_name,
+            "cluster": {"server": server_url},
+        }
+    )
+
+    # Add or update user with exec command
+    config["users"] = [u for u in config.get("users", []) if u["name"] != user_name]
+    config["users"].append(
+        {
+            "name": user_name,
+            "user": {
+                "exec": {
+                    "apiVersion": "client.authentication.k8s.io/v1beta1",
+                    "command": exec_command[0],
+                    "args": exec_command[1:],
+                    "env": (
+                        [{"name": k, "value": v} for k, v in envs.items()]
+                        if envs
+                        else []
+                    ),
+                }
+            },
+        }
+    )
+
+    # Add or update context
+    config["contexts"] = [
+        c for c in config.get("contexts", []) if c["name"] != context_name
+    ]
+    config["contexts"].append(
+        {"name": context_name, "context": {"cluster": cluster_name, "user": user_name}}
+    )
+    return context_name
+
+
+def get_cluster_context(
+    config: Dict[str, Any], cluster: str
+) -> Optional[Dict[str, Any]]:
+    cluster_name: str = CLUSTER_NAME_FORMAT.format(cluster=cluster)
+    return next(
+        (c for c in config.get("clusters", []) if c["name"] == cluster_name), None
+    )
+
+
+def get_cluster_server_url(config: Dict[str, Any], cluster: str) -> Optional[str]:
+    cluster: Optional[Dict[str, Any]] = get_cluster_context(config, cluster)
+    if cluster:
+        return cluster["cluster"].get("server")
+    return None

truefoundry-0.7.0rc5/truefoundry/deploy/io/no_output_callback.py

@@ -0,0 +1,27 @@
+from typing import Any, List, Optional
+
+from truefoundry.deploy.io.output_callback import OutputCallBack
+
+
+class NoOutputCallBack(OutputCallBack):
+    def print_header(self, line: Any) -> None:
+        pass
+
+    def _print_separator(self) -> None:
+        pass
+
+    def print_line(self, line: str) -> None:
+        pass
+
+    def print_lines_in_panel(
+        self, lines: List[str], header: Optional[str] = None
+    ) -> None:
+        pass
+
+    def print_code_in_panel(
+        self, lines: List[str], header: Optional[str] = None
+    ) -> None:
+        pass
+
+    def print(self, line: Any) -> None:
+        pass

{truefoundry-0.7.0rc3 → truefoundry-0.7.0rc5}/truefoundry/deploy/lib/clients/servicefoundry_client.py

@@ -32,6 +32,7 @@ from truefoundry.deploy._autogen import models as autogen_models
 from truefoundry.deploy.io.output_callback import OutputCallBack
 from truefoundry.deploy.lib.model.entity import (
     Application,
+    Cluster,
     CreateDockerRepositoryResponse,
     Deployment,
     DockerRegistryCredentials,
@@ -110,6 +111,13 @@ class ServiceFoundryServiceClient(BaseServiceFoundryServiceClient):
         )
         return request_handling(response)
 
+    @check_min_cli_version
+    def list_clusters(self) -> List[Cluster]:
+        url = f"{self._api_server_url}/{VERSION_PREFIX}/clusters"
+        response = session_with_retries().get(url, headers=self._get_headers())
+        response = request_handling(response)
+        return parse_obj_as(List[Cluster], response["data"])
+
     @check_min_cli_version
     def list_workspaces(
         self,

{truefoundry-0.7.0rc3 → truefoundry-0.7.0rc5}/truefoundry/deploy/lib/model/entity.py

@@ -34,6 +34,11 @@ class Entity(Base):
     updatedAt: datetime.datetime = Field(repr=False)
 
 
+class Cluster(Entity):
+    id: str
+    cloudProvider: str
+
+
 class Workspace(Entity):
     id: str = Field(repr=False)
     name: str

{truefoundry-0.7.0rc3 → truefoundry-0.7.0rc5}/truefoundry/deploy/lib/session.py

@@ -70,7 +70,9 @@ def login(
         else:
             auth_service = AuthServiceClient.from_tfy_host(tfy_host=host)
             # interactive login
-            token = _login_with_device_code(base_url=host, auth_service=auth_service)
+            token = _login_with_device_code(
+                base_url=host, auth_service=auth_service, output_hook=output_hook
+            )
 
         cred_file_content = CredentialsFileContent(
             access_token=token.access_token,
@@ -97,7 +99,7 @@ def logout(
 
 
 def get_access_token():
-    # Create a new session which handles token refresh
+    # Get the access token from the session
     session = Session.new()
     return session.access_token