zenml-nightly 0.84.2.dev20250827__tar.gz → 0.84.3.dev20250828__tar.gz

{zenml_nightly-0.84.2.dev20250827 → zenml_nightly-0.84.3.dev20250828}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: zenml-nightly
-Version: 0.84.2.dev20250827
+Version: 0.84.3.dev20250828
 Summary: ZenML: Write production-ready ML code.
 License: Apache-2.0
 Keywords: machine learning,production,pipeline,mlops,devops
@@ -54,7 +54,7 @@ Requires-Dist: azure-storage-blob (>=12.0.0) ; extra == "connectors-azure"
 Requires-Dist: bandit (>=1.7.5,<2.0.0) ; extra == "dev"
 Requires-Dist: bcrypt (==4.0.1)
 Requires-Dist: boto3 (>=1.16.0) ; extra == "secrets-aws" or extra == "connectors-aws"
-Requires-Dist: click (>=8.0.1,<8.1.8)
+Requires-Dist: click (>=8.0.1,<=8.2.1)
 Requires-Dist: cloudpickle (>=2.0.0,<3)
 Requires-Dist: copier (>=8.1.0) ; extra == "templates"
 Requires-Dist: coverage[toml] (>=5.5,<6.0) ; extra == "dev"

{zenml_nightly-0.84.2.dev20250827 → zenml_nightly-0.84.3.dev20250828}/RELEASE_NOTES.md

@@ -1,5 +1,42 @@
 <!-- markdown-link-check-disable -->
 
+# 0.84.3
+
+The `0.84.3` release introduces **ZenML Pro service account authentication** support and includes important **Kubernetes integration fixes**. This release enhances authentication flexibility for automated workflows and improves the reliability of Kubernetes-based orchestration.
+
+## 🚀 New Features
+
+### ZenML Pro Service Account Authentication
+- **CLI Login Support**: Added ability to authenticate with ZenML Pro using service account API keys via `zenml login --api-key`
+- **Programmatic Access**: Service account API keys can now be used for programmatic access to ZenML Pro workspaces
+- **Organization-Level Access**: Service accounts provide access to all workspaces within an organization for automated workflows
+
+## 🛠️ Fixes
+
+### Kubernetes Integration
+- **Name Sanitization**: Fixed Kubernetes resource name sanitization to properly handle special characters and ensure compliance with Kubernetes naming requirements
+
+### Dependencies
+- **Click Version**: Relaxed Click dependency version constraints to improve compatibility with other packages
+
+## What's Changed
+* Add version 0.84.1 to legacy docs by @github-actions[bot] in https://github.com/zenml-io/zenml/pull/3885
+* Fix PyPI download stats badge by @strickvl in https://github.com/zenml-io/zenml/pull/3882
+* Don't include decorator code in step cache key computation by @schustmi in https://github.com/zenml-io/zenml/pull/3880
+* Add an agent in production example by @htahir1 in https://github.com/zenml-io/zenml/pull/3890
+* Fix kubernetes name sanitization by @schustmi in https://github.com/zenml-io/zenml/pull/3887
+* Fix SyntaxWarning in `exception_utils` regex pattern by @strickvl in https://github.com/zenml-io/zenml/pull/3892
+* Add agent framework integration examples by @htahir1 in https://github.com/zenml-io/zenml/pull/3898
+* Add weekly agent examples test workflow by @strickvl in https://github.com/zenml-io/zenml/pull/3902
+* Add ability to use a ZenML Pro API key with `zenml login` by @stefannica in https://github.com/zenml-io/zenml/pull/3895
+* Add docs for workload manager env vars by @schustmi in https://github.com/zenml-io/zenml/pull/3907
+* Bump allowed versions of click by @strickvl in https://github.com/zenml-io/zenml/pull/3905
+* Allow workspace service accounts and API keys to be created by @stefannica in https://github.com/zenml-io/zenml/pull/3908
+
+
+**Full Changelog**: https://github.com/zenml-io/zenml/compare/0.84.2...0.84.3
+
+
 # 0.84.2
 
 The `0.84.2` release brings significant **performance improvements** and **reliability enhancements** that strengthen ZenML's orchestration capabilities. This release features a major refactor of the Kubernetes orchestrator with enhanced restart capabilities, faster pipeline compilation for large pipelines, critical security fixes, and improved logging performance.

{zenml_nightly-0.84.2.dev20250827 → zenml_nightly-0.84.3.dev20250828}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "zenml-nightly"
-version = "0.84.2.dev20250827"
+version = "0.84.3.dev20250828"
 packages = [{ include = "zenml", from = "src" }]
 description = "ZenML: Write production-ready ML code."
 authors = ["ZenML GmbH <info@zenml.io>"]
@@ -43,7 +43,7 @@ zenml = "zenml.cli.cli:cli"
 [tool.poetry.dependencies]
 alembic = { version = ">=1.8.1,<=1.15.2" }
 bcrypt = { version = "4.0.1" }
-click = "^8.0.1,<8.1.8"
+click = "^8.0.1,<=8.2.1"
 cloudpickle = ">=2.0.0,<3"
 distro = "^1.6.0"
 docker = "~7.1.0"
@@ -493,4 +493,4 @@ module = [
     "uvloop.*",
     "litellm",
 ]
-ignore_missing_imports = true
+ignore_missing_imports = true

zenml_nightly-0.84.3.dev20250828/src/zenml/VERSION

@@ -0,0 +1 @@
+0.84.3.dev20250828

{zenml_nightly-0.84.2.dev20250827 → zenml_nightly-0.84.3.dev20250828}/src/zenml/cli/login.py

@@ -254,7 +254,7 @@ def connect_to_server(
             # flow.
             cli_utils.declare(f"Authenticating to ZenML server '{url}'...")
         else:
-            if refresh or not credentials_store.has_valid_authentication(url):
+            if refresh or not credentials_store.has_valid_credentials(url):
                 cli_utils.declare(
                     f"Authenticating to ZenML server '{url}' using the web "
                     "login..."
@@ -331,6 +331,17 @@ def connect_to_pro_server(
 
     server_id, server_url, server_name = None, None, None
     login = False
+    credentials_store = get_credentials_store()
+
+    if api_key and api_key.startswith("ZENPROKEY_"):
+        if not pro_server:
+            raise ValueError(
+                "You must provide the name of the ZenML Pro server when "
+                "connecting with a ZenML Pro API key."
+            )
+        credentials_store.set_api_key(pro_api_url, api_key, is_zenml_pro=True)
+        api_key = None
+
     if not pro_server:
         login = True
         if api_key:
@@ -351,8 +362,7 @@ def connect_to_pro_server(
     else:
         server_url = pro_server
 
-    credentials_store = get_credentials_store()
-    if not credentials_store.has_valid_pro_authentication(pro_api_url):
+    if not credentials_store.has_valid_pro_credentials(pro_api_url):
         # Without valid ZenML Pro credentials, we can only connect to a ZenML
         # Pro server with an API key and we also need to know the URL of the
         # server to connect to.
@@ -375,10 +385,9 @@ def connect_to_pro_server(
 
     if login or refresh:
         # If we reached this point, then we need to start a new login flow.
-        # We also need to remove all existing API tokens associated with the
-        # target ZenML Pro API, otherwise they will continue to be used after
-        # the re-login flow.
-        credentials_store.clear_all_pro_tokens()
+        # We also need to remove all existing credentials, otherwise they will
+        # continue to be used after the re-login flow.
+        credentials_store.clear_all_credentials()
         try:
             token = web_login(
                 pro_api_url=pro_api_url,
@@ -858,10 +867,21 @@ def login(
         )
         return
 
+    api_key_value: Optional[str] = None
+    if api_key:
+        # Read the API key from the user
+        api_key_value = click.prompt(
+            "Please enter the API key for the ZenML server",
+            type=str,
+            hide_input=True,
+        )
+        if api_key_value and api_key_value.startswith("ZENPROKEY_"):
+            pro = True
+
     if pro:
         connect_to_pro_server(
             pro_server=server,
-            refresh=True,
+            api_key=api_key_value,
             pro_api_url=pro_api_url,
             verify_ssl=ssl_ca_cert
             if ssl_ca_cert is not None
@@ -877,15 +897,6 @@ def login(
         if not connected_to_local_server():
             current_non_local_server = store_cfg.url
 
-    api_key_value: Optional[str] = None
-    if api_key:
-        # Read the API key from the user
-        api_key_value = click.prompt(
-            "Please enter the API key for the ZenML server",
-            type=str,
-            hide_input=True,
-        )
-
     verify_ssl: Union[str, bool] = (
         ssl_ca_cert if ssl_ca_cert is not None else not no_verify_ssl
     )
@@ -1126,7 +1137,7 @@ def logout(
 
         pro_api_url = pro_api_url or ZENML_PRO_API_URL
         pro_api_url = pro_api_url.rstrip("/")
-        if credentials_store.has_valid_pro_authentication(pro_api_url):
+        if credentials_store.get_pro_credentials(pro_api_url):
             credentials_store.clear_pro_credentials(pro_api_url)
             cli_utils.declare("Logged out from ZenML Pro.")
         else:
@@ -1141,7 +1152,7 @@ def logout(
             if credentials and credentials.pro_api_url == pro_api_url:
                 gc.set_default_store()
 
-            credentials_store.clear_all_pro_tokens(pro_api_url)
+            credentials_store.clear_all_credentials()
             cli_utils.declare("Logged out from all ZenML Pro servers.")
         return
 

{zenml_nightly-0.84.2.dev20250827 → zenml_nightly-0.84.3.dev20250828}/src/zenml/cli/server.py

@@ -217,12 +217,12 @@ def status() -> None:
         if server:
             if server.type == ServerType.PRO:
                 # If connected to a ZenML Pro server, refresh the server info
-                pro_credentials = credentials_store.get_pro_credentials(
-                    pro_api_url=server.pro_api_url or ZENML_PRO_API_URL,
-                    allow_expired=False,
-                )
-                if pro_credentials:
-                    pro_client = ZenMLProClient(pro_credentials.url)
+                if credentials_store.can_login(
+                    server_url=server.pro_api_url or ZENML_PRO_API_URL,
+                ):
+                    pro_client = ZenMLProClient(
+                        server.pro_api_url or ZENML_PRO_API_URL
+                    )
                     pro_servers = pro_client.workspace.list(
                         url=store_cfg.url, member_only=True
                     )
@@ -240,10 +240,6 @@ def status() -> None:
                 cli_utils.declare(
                     f"  ZenML Pro Organization: {server.organization_hyperlink}"
                 )
-                if pro_credentials:
-                    cli_utils.declare(
-                        f"  ZenML Pro authentication: {pro_credentials.auth_status}"
-                    )
             else:
                 cli_utils.declare(
                     f"Connected to a remote ZenML server: `{server.dashboard_hyperlink}`"

{zenml_nightly-0.84.2.dev20250827 → zenml_nightly-0.84.3.dev20250828}/src/zenml/login/credentials.py

@@ -138,6 +138,33 @@ class ServerCredentials(BaseModel):
             return ServerType.LOCAL
         return ServerType.REMOTE
 
+    @property
+    def can_refresh_token(self) -> bool:
+        """Check if the credentials can be used to refresh the API token.
+
+        A token refresh is only possible if long-lived credentials exist that
+        can be used to login and generate a new API token.
+
+        Returns:
+            True if the server credentials can be used to refresh the API token,
+            False otherwise.
+        """
+        return (
+            self.username is not None
+            and self.password is not None
+            or self.api_key is not None
+            or self.type == ServerType.LOCAL
+        )
+
+    @property
+    def has_valid_token(self) -> bool:
+        """Check if the API token is valid.
+
+        Returns:
+            True if the API token is valid, False otherwise.
+        """
+        return self.api_token is not None and not self.api_token.expired
+
     def update_server_info(
         self, server_info: Union[ServerModel, WorkspaceRead]
     ) -> None:

{zenml_nightly-0.84.2.dev20250827 → zenml_nightly-0.84.3.dev20250828}/src/zenml/login/credentials_store.py

@@ -54,12 +54,15 @@ class CredentialsStore(metaclass=SingletonMetaClass):
         1. when the user runs `zenml login` to authenticate to a ZenML Pro
         server, the ZenML Pro API token fetched from the web login flow is
         stored in the Credentials Store.
-        2. when the user runs `zenml login` to authenticate to a regular ZenML
+        2. when the user runs `zenml login` to authenticate to a ZenML Pro
+        server using an API key, the ZenML Pro API key is stored in the
+        Credentials Store.
+        3. when the user runs `zenml login` to authenticate to a regular ZenML
         server with the web login flow, the ZenML server API token fetched
         through the web login flow is stored in the Credentials Store
-        3. when the user runs `zenml login` to authenticate to any ZenML server
+        4. when the user runs `zenml login` to authenticate to any ZenML server
         using an API key, the API key is stored in the Credentials Store
-        4. when the REST zen store is initialized, it starts up not yet
+        5. when the REST zen store is initialized, it starts up not yet
         authenticated. Then, if/when it needs to authenticate or re-authenticate
         to the remote server, it will use whatever form of credentials it finds
         in the Credentials Store, in order of priority:
@@ -71,8 +74,12 @@ class CredentialsStore(metaclass=SingletonMetaClass):
             * for ZenML servers that use an API key to authenticate, it will use
             that to fetch a short-lived ZenML Pro server API token that it also
             stores in the Credentials Store
-            * for ZenML Pro servers, it exchanges the longer-lived ZenML Pro API
-            token into a short lived ZenML Pro server API token
+            * for ZenML Pro servers:
+                * if a valid ZenML Pro API token is found, it exchanges it into
+                a short lived ZenML Pro server API token
+                * otherwise, if a ZenML Pro API key is found, it will use that
+                to fetch a short-lived ZenML Pro server API token that it also
+                stores in the Credentials Store
 
     Alongside credentials, the Credentials Store is also used to store
     additional server information:
@@ -290,6 +297,37 @@ class CredentialsStore(metaclass=SingletonMetaClass):
         self.check_and_reload_from_file()
         return self.credentials.get(server_url)
 
+    def has_valid_credentials(self, server_url: str) -> bool:
+        """Check if valid credentials exist for a specific server URL.
+
+        Args:
+            server_url: The server URL for which to check the authentication.
+
+        Returns:
+            True if the credentials store contains credentials that can be used
+            to login to the given server URL, False otherwise.
+        """
+        credentials = self.get_credentials(server_url)
+        if credentials and (
+            credentials.has_valid_token or credentials.can_refresh_token
+        ):
+            return True
+        return False
+
+    def get_pro_api_key(self, pro_api_url: str) -> Optional[str]:
+        """Retrieve an API key from the credentials store for a ZenML Pro API server.
+
+        Args:
+            pro_api_url: The URL of the ZenML Pro API server.
+
+        Returns:
+            The stored API key if it exists, None otherwise.
+        """
+        credential = self.get_pro_credentials(pro_api_url)
+        if credential and credential.api_key:
+            return credential.api_key
+        return None
+
     def get_pro_token(
         self, pro_api_url: str, allow_expired: bool = False
     ) -> Optional[APIToken]:
@@ -304,98 +342,58 @@ class CredentialsStore(metaclass=SingletonMetaClass):
         Returns:
             The stored token if it exists and is not expired, None otherwise.
         """
-        credential = self.get_pro_credentials(pro_api_url, allow_expired)
+        credential = self.get_pro_credentials(pro_api_url)
         if credential:
-            return credential.api_token
+            token = credential.api_token
+            if token and (not token.expired or allow_expired):
+                return token
         return None
 
     def get_pro_credentials(
-        self, pro_api_url: str, allow_expired: bool = False
+        self, pro_api_url: str
     ) -> Optional[ServerCredentials]:
-        """Retrieve a valid token from the credentials store for a ZenML Pro API server.
+        """Retrieve valid credentials from the credentials store for a ZenML Pro API server.
 
         Args:
             pro_api_url: The URL of the ZenML Pro API server.
-            allow_expired: Whether to allow expired tokens to be returned. The
-                default behavior is to return None if a token does exist but is
-                expired.
 
         Returns:
-            The stored credentials if they exist and are not expired, None otherwise.
+            The stored credentials if they exist, None otherwise.
         """
         credential = self.get_credentials(pro_api_url)
-        if (
-            credential
-            and credential.type == ServerType.PRO_API
-            and credential.api_token
-            and (not credential.api_token.expired or allow_expired)
-        ):
+        if credential and credential.type == ServerType.PRO_API:
             return credential
         return None
 
-    def clear_pro_credentials(self, pro_api_url: str) -> None:
-        """Delete the token from the store for a ZenML Pro API server.
-
-        Args:
-            pro_api_url: The URL of the ZenML Pro API server.
-        """
-        self.clear_token(pro_api_url)
-
-    def clear_all_pro_tokens(
-        self, pro_api_url: Optional[str] = None
-    ) -> List[ServerCredentials]:
-        """Delete all tokens from the store for ZenML Pro servers connected to a given API server.
+    def has_valid_pro_credentials(self, pro_api_url: str) -> bool:
+        """Check if valid credentials exist for a ZenML Pro API server.
 
         Args:
             pro_api_url: The URL of the ZenML Pro API server.
 
         Returns:
-            A list of the credentials that were cleared.
-        """
-        credentials_to_clear = []
-        for server_url, server in self.credentials.copy().items():
-            if (
-                server.type == ServerType.PRO
-                and server.pro_api_url
-                and (pro_api_url is None or server.pro_api_url == pro_api_url)
-            ):
-                if server.api_key:
-                    continue
-                self.clear_token(server_url)
-                credentials_to_clear.append(server)
-        return credentials_to_clear
-
-    def has_valid_authentication(self, url: str) -> bool:
-        """Check if a valid authentication credential for the given server URL is stored.
-
-        Args:
-            url: The server URL for which to check the authentication.
-
-        Returns:
-            bool: True if a valid token or API key is stored, False otherwise.
+            True if the credentials store contains credentials that can be used
+            to login to the given ZenML Pro API server, False otherwise.
         """
-        self.check_and_reload_from_file()
-        credential = self.credentials.get(url)
-
-        if not credential:
-            return False
-        if credential.api_key or (
-            credential.username and credential.password is not None
+        credentials = self.get_pro_credentials(pro_api_url)
+        if credentials and (
+            credentials.has_valid_token or credentials.can_refresh_token
         ):
             return True
-        token = credential.api_token
-        return token is not None and not token.expired
+        return False
 
-    def has_valid_pro_authentication(self, pro_api_url: str) -> bool:
-        """Check if a valid token for a ZenML Pro API server is stored.
+    def clear_pro_credentials(self, pro_api_url: str) -> None:
+        """Delete the token from the store for a ZenML Pro API server.
 
         Args:
             pro_api_url: The URL of the ZenML Pro API server.
-
-        Returns:
-            bool: True if a valid token is stored, False otherwise.
         """
-        return self.get_pro_token(pro_api_url) is not None
+        self.clear_token(pro_api_url)
+
+    def clear_all_credentials(self) -> None:
+        """Delete all stored credentials."""
+        self.credentials = {}
+        self._save_credentials()
 
     def can_login(self, server_url: str) -> bool:
         """Check if credentials to login to the given server exist.
@@ -407,22 +405,20 @@ class CredentialsStore(metaclass=SingletonMetaClass):
             True if the credentials store contains credentials that can be used
             to login to the given server URL, False otherwise.
         """
-        self.check_and_reload_from_file()
         credentials = self.get_credentials(server_url)
         if not credentials:
             return False
 
-        if credentials.api_key is not None:
-            return True
-        elif (
-            credentials.username is not None
-            and credentials.password is not None
-        ):
+        if credentials.can_refresh_token:
             return True
-        elif credentials.type == ServerType.PRO:
+
+        if credentials.type == ServerType.PRO:
             pro_api_url = credentials.pro_api_url or ZENML_PRO_API_URL
-            pro_token = self.get_pro_token(pro_api_url, allow_expired=False)
-            if pro_token:
+            pro_credentials = self.get_pro_credentials(pro_api_url)
+            if pro_credentials and (
+                pro_credentials.has_valid_token
+                or pro_credentials.can_refresh_token
+            ):
                 return True
 
         return False
@@ -431,6 +427,7 @@ class CredentialsStore(metaclass=SingletonMetaClass):
         self,
         server_url: str,
         api_key: str,
+        is_zenml_pro: bool = False,
     ) -> None:
         """Store an API key in the credentials store for a specific server URL.
 
@@ -440,6 +437,7 @@ class CredentialsStore(metaclass=SingletonMetaClass):
         Args:
             server_url: The server URL for which the token is to be stored.
             api_key: The API key to store.
+            is_zenml_pro: Whether the API key is for the ZenML Pro API.
         """
         self.check_and_reload_from_file()
         credential = self.credentials.get(server_url)
@@ -450,9 +448,11 @@ class CredentialsStore(metaclass=SingletonMetaClass):
             credential.api_key = api_key
             credential.username = None
             credential.password = None
+            if is_zenml_pro:
+                credential.pro_api_url = server_url
         else:
             self.credentials[server_url] = ServerCredentials(
-                url=server_url, api_key=api_key
+                url=server_url, api_key=api_key, pro_api_url=server_url
             )
 
         self._save_credentials()