enkindler 0.10.0

Command-line interface for the Enkindler AI operations dashboard.

enkindler CLI

Command-line interface for the Enkindler AI operations dashboard. Manages AKS deployments, Helm platforms, integrations, and cluster resources from your terminal.

Patterned after az and databricks — designed to be ergonomic for both humans and AI agents.

Install

pip install enkindler

Works on macOS, Linux, and Windows (Python 3.10+).

Quick start

# Sign in: generate a CLI token on the dashboard's /cli-token page, then paste it
enkindler login --token

# Or the browser convenience flow (requires the cluster's Entra loopback redirect URI)
enkindler login

# Verify the session
enkindler whoami

# List your deployments
enkindler deployment list

Namespaces

One workload (app, platform, or CronJob) is allowed per namespace. Workload create commands (deployment create, helm install, cronjob create) require --namespace <full-aks-namespace> — the full name, already workspace-prefixed as <workspace-slug>-<name> (e.g. workspace finance → finance-invoices). The backend rejects names outside the active workspace.

Pre-flight a namespace before creating (checks both workload occupancy and the admin-managed restricted-namespaces denylist; exits 1 if taken):

enkindler namespace occupancy                               # occupied namespaces in the workspace
enkindler namespace occupancy --namespace finance-invoices  # single-candidate check

Platform admins manage the denylist with enkindler settings update --set 'RESTRICTED_NAMESPACES=legacy-ns,shared-infra' (system namespaces like default and kube-system are always restricted). A workload's namespace is immutable after creation.

Configuration

Config and the cached JWT live at:

OS	Path
macOS	~/Library/Application Support/enkindler/config.toml
Linux	~/.config/enkindler/config.toml
Windows	%APPDATA%\enkindler\config.toml

Override the backend URL with --api-url https://... on any command, or set ENKINDLER_API_URL in the environment.

Architecture

• Backend exposes an OpenAPI spec at /api/openapi.json (the contract).
• This CLI consumes that spec to drive command behaviour.
• Auth uses backend-issued tokens: sign in to the web dashboard, generate a CLI token at /cli-token, and paste it at the enkindler login --token prompt. A browser OAuth (PKCE) flow is available via plain enkindler login on clusters whose Azure app registration allows loopback redirects.

Development

python -m venv .venv && source .venv/bin/activate  # or `.venv\Scripts\activate` on Windows
pip install -e '.[dev]'
pytest
ruff check .

License

MIT