From 74cebdf682ce35e9381062071e661193817e9ebc Mon Sep 17 00:00:00 2001 From: Maria Jose Ferreira Fernandes <171664470+MariaJoseFF@users.noreply.github.com> Date: Fri, 16 Oct 2026 21:25:05 +0200 Subject: [PATCH] Document te vertipaq --push and always-cached SPN login (#6404) te vertipaq: --save is now --push, documented with the CLI help text for --annotate and --push and an example. te auth login: --save=false is gone; service-principal credentials are always cached, and --auth env with the AZURE_CLIENT_* variables is the route that writes nothing to the machine. Co-Authored-By: Claude Opus 5.5 (1M context) --- content/features/te-cli/te-cli-auth.md | 4 +++- content/features/te-cli/te-cli-commands.md | 5 ++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/content/features/te-cli/te-cli-auth.md b/content/features/te-cli/te-cli-auth.md index 3348d29f2..12a5240b3 100644 --- a/content/features/te-cli/te-cli-auth.md +++ b/content/features/te-cli/te-cli-auth.md @@ -60,7 +60,9 @@ te auth login -u "$AZURE_CLIENT_ID" -t "$AZURE_TENANT_ID" --certificate ./sp.pfx te auth login --identity # Alias: -I ``` -After a successful service-principal login the CLI **caches the credentials** so every subsequent `te` command can acquire tokens silently - no need to re-pass `-u / -p / -t` or set the `AZURE_CLIENT_*` environment variables. Pass `--save=false` for a one-shot login that doesn't update the cache, or run `te auth logout` to clear it. +After a successful service-principal login the CLI **caches the credentials** so every subsequent `te` command can acquire tokens silently - no need to re-pass `-u / -p / -t` or set the `AZURE_CLIENT_*` environment variables. Service-principal credentials passed to `te auth login` (client secret or certificate) are always cached. Run `te auth logout` to clear the cache. + +To authenticate a service principal without writing anything to the machine, skip `te auth login`: set `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET` and `AZURE_TENANT_ID`, and pass `--auth env` to each `te` command. The CLI authenticates per invocation and caches nothing - see [Non-interactive authentication](#non-interactive-authentication). > [!WARNING] > Passing secrets directly on the command line exposes them to process listings and shell history. Prefer the `AZURE_CLIENT_SECRET` environment variable, or pipe the secret via stdin with `-p -`. diff --git a/content/features/te-cli/te-cli-commands.md b/content/features/te-cli/te-cli-commands.md index 3e0f0ae6f..17a9e7a69 100644 --- a/content/features/te-cli/te-cli-commands.md +++ b/content/features/te-cli/te-cli-commands.md @@ -705,7 +705,9 @@ Analyze VertiPaq storage statistics. - `--export ` - export VertiPaq stats to a `.vpax` file for offline analysis. - `--import ` - load a previously exported `.vpax` file and analyze it offline. - `--obfuscate` - obfuscate names and expressions in exported VPAX. -- `--top `, `--stats`, `--annotate`, `--save`. +- `--top `, `--stats`. +- `--annotate` - write stats as annotations on each model object (table size, column size, cardinality, etc.). Without `--push`, the annotations are only prepared, not written to the workspace. +- `--push` - push the annotations prepared by `--annotate` back to the workspace. Requires `--annotate`; not available with `--import`. - `--auth ` - auth method override when connecting to a remote model. ```bash @@ -714,6 +716,7 @@ te vertipaq Sales # Stats limited to the Sales table te vertipaq --all # Tables, columns, relationships, partitions te vertipaq --export stats.vpax te vertipaq --import stats.vpax # Analyze offline +te vertipaq --annotate --push # Write stats as annotations and push them to the workspace ``` ### Formatting expressions