Skip to content

README.md

Latest commit

 

History

History
133 lines (109 loc) · 7.06 KB

README.md

File metadata and controls

133 lines (109 loc) · 7.06 KB
Raw

PastureStack Web Console

Web Console is the browser interface for environments, hosts, stacks, services, containers, catalogs, storage, networking, access control, and administration.

PastureStack is an independent community effort to preserve and modernize the Rancher 1.6 ecosystem. It is not affiliated with Rancher Labs or SUSE. This fork of rancher/ui preserves upstream history, authorship, licenses, and dependency notices.

Current component

Web Console 1.6.201 / bridge 0.2.3 is published with the original qualified CI artifacts. All 13 public release assets matched their recorded SHA256 values.

The client retains twelve tools and extends typed workflows for External Services, DNS Aliases and audit metadata. Alias creation and selecting targets are separate human-reviewed changes. Queries use opaque references; no raw resource IDs, private audit payloads or credentials are exposed to tools. Matching Engine 0.183.360 and broker audit-query components are required.

Normal UI, session, Full-access, existing Catalog/Archive and human-confirmation protections remain. Web component CI/CodeQL, archive/SBOM qualification and the standalone ZIP's clean install passed. Matching Engine 0.183.360 and Server 560 qualification, combined runtime and designated browser/role/weak-model acceptance remain pending. The designated 8080 QA deployment remains Server v1.6.559 / Web 1.6.200; publication does not establish the new domains' runtime acceptance. The release note records provenance and remaining boundaries. This release does not complete all 243 business groups.

The release producer uses Node.js 24.22.1 / npm 12.0.2 and separate runtime / build CycloneDX SBOMs. Dependencies remain unchanged. Use the Server installation guide for deployment. Historical published evidence remains in release notes.

Features and operator guides

  • Experimental AI collaboration: twelve typed tools for resource discovery, conditional descriptions and server-owned lifecycle plans. Disabled by default. Includes human review controls and an optional dedicated-Key stdio bridge; native browser tools require a supported secure-context browser.
  • Role-aware navigation and resource actions use API schema capabilities; the backend remains the authorization authority.
  • API Keys: capability-gated access policies, expiration, reviewed changes with platform MFA, and per-key audit. Grants remain bounded by live owner permissions; new secrets are shown once. Legacy Keys and servers without policy capability retain the existing workflow.
  • Resources and hardware: shared memory, runtimes, GPU/graphics devices, and advanced container limits. Options require compatible API/agent versions and host capabilities; device visibility is not exclusive GPU allocation.
  • OpenID Connect: provider configuration, stable identity assignment, provider switching, and local recovery.
  • Multi-factor authentication: TOTP, passkeys, recovery codes, account recovery, and administrator controls.
  • Console workspace: movable terminal, log, and VM console windows. Live entries can reconnect; ended entries do not reopen through late callbacks or remounts. Open a new entry explicitly after ending a session.
  • Operator-selected storage removal: selection, preview, confirmation, and bounded concurrent removal.

Catalog translations use optional io.pasturestack.catalog.name.<locale> and io.pasturestack.catalog.description.<locale> labels. Unknown locales and third-party catalogs fall back to canonical metadata.

Machine driver cards display each driver's API name, including drivers that share the generic icon. Catalog driver cards retain localized catalog names.

Workload archiving

The Archive switch before stack sorting includes archived stacks and services; it is off by default and remembers each user's choice separately for each environment. Hidden counts do not replace actual resource totals. Direct detail links remain available, with an archived badge and Restore in the existing menu.

Archiving requires a compatible server, the resource's existing update capability, and completely stopped services and containers. System and infrastructure resources cannot be archived. Archive only changes the persisted archived flag: it does not stop, delete, or recreate anything. Mounted directories and volumes remain; back up their source data yourself before moving hosts or deleting mount sources. Restore the resource and its parent stack before starting it or adding services. Restoring a stack preserves independently archived child services.

Build and test

Use the supported toolchain in COMPATIBILITY.md:

npm ci --ignore-scripts
npm run build -- --environment=production
npm test

To produce a release candidate with Docker, use the same isolated producer as CI. It installs the frozen application and schema-verifier dependencies, captures final module/file evidence, packages twice, verifies both SBOM sets and writes the release sidecars to a dedicated output directory:

export GITHUB_SHA=$(git rev-parse HEAD)
export SOURCE_DATE_EPOCH=$(git show -s --format=%ct "$GITHUB_SHA")
export VALIDATION_SCOPE=sbom
export WEBMCP_MODE=off
release_dir=$(mktemp -d)
bash scripts/build-ui-release-candidate "$release_dir"

The archive root and VERSION.txt match the numeric package version. Runtime inventory is checked against the packaged tree, including packaging exclusions, rather than the raw Ember output. This command creates a candidate; publication is a separate reviewed step. See SBOM boundaries.

WEBMCP_MODE is the AI collaboration capability ceiling (off, read-only, or enabled); the producer and workflow default to off. Select enabled explicitly to include the full collaboration panel and tools. Every new page still starts with browser tools off, until the user opts in through that panel. The archive's webmcp-build.json and matching *-webmcp.json release sidecar record the ceiling and fixed initialMode: off; their bytes are covered by the archive/manifest and sidecar checksums. Publish one selected profile per version.

Component tests, artifact verification, and real-host/browser acceptance are separate evidence. Do not infer full resource/role/hardware coverage from a successful build. See SECURITY.md and ORIGIN.md for security boundaries and provenance.

License and attribution

The inherited project uses Apache License 2.0, with attribution in COPYRIGHT_DETAILS.md. Bundled dependencies retain their own licenses and notices. Contributors claim authorship only for their changes.