Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 14 additions & 14 deletions src/.vitepress/routes/sidebar/admin.ts
Original file line number Diff line number Diff line change
Expand Up @@ -11,26 +11,26 @@ export const adminRoutes = [
text: 'Hub',
collapsed: true,
items: [
{text: 'Realms', link: '/realms'},
{text: 'Identity Providers', link: '/identity-providers'},
{text: 'Robots', link: '/robots'},
{text: 'Users', link: '/users'},
{text: 'Roles', link: '/roles'},
{text: 'Permissions', link: '/permissions'},
{text: 'Nodes', link: '/node-management'},
{text: 'Project Review', link: '/project-review'},
{text: 'Analysis Review', link: '/analysis-review'},
{ text: 'Realms', link: '/realms' },
{ text: 'Identity Providers', link: '/identity-providers' },
{ text: 'Clients', link: '/clients' },
{ text: 'Users', link: '/users' },
{ text: 'Roles', link: '/roles' },
{ text: 'Permissions', link: '/permissions' },
{ text: 'Nodes', link: '/node-management' },
{ text: 'Project Review', link: '/project-review' },
{ text: 'Analysis Review', link: '/analysis-review' },
]
},
{
text: 'Node',
collapsed: true,
items: [
{text: 'Bucket Setup for Data Store', link: '/bucket-setup-for-data-store'},
{text: 'Data Store Management', link: '/data-store-management'},
{text: 'Analysis Execution', link: '/analysis-execution'},
{text: 'Keycloak & Access Control', link: '/keycloak-access-control'},
{text: 'Analysis Definition in k8s', link: '/analysis-definition'},
{ text: 'Bucket Setup for Data Store', link: '/bucket-setup-for-data-store' },
{ text: 'Data Store Management', link: '/data-store-management' },
{ text: 'Analysis Execution', link: '/analysis-execution' },
{ text: 'Keycloak & Access Control', link: '/keycloak-access-control' },
{ text: 'Analysis Definition in k8s', link: '/analysis-definition' },
]
},
]
2 changes: 1 addition & 1 deletion src/getting-started/components.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ Hub components/services are individual packages/services within one monorepo.
| **RabbitMQ** | [rabbitmq/rabbitmq-server](https://github.com/rabbitmq/rabbitmq-server) | Starlark |
| **Vault** | [hashicorp/vault](https://github.com/hashicorp/vault) | Go/JavaScript |

* `Authup` - Identity and Access Management (IAM) to manage users, roles, robots, permissions, ...
* `Authup` - Identity and Access Management (IAM) to manage users, roles, clients, permissions, ...
* `Harbor` - Harbor is a docker registry to distribute images. In the context of the PrivateAim it is used for train distribution across multiple locations.
* `RabbitMQ` - RabbitMQ is a message broker. It is used for the communication between microservices.
* `Vault` - Vault is a secret storage service for managing and storing sensitive information.
Expand Down
30 changes: 15 additions & 15 deletions src/guide/admin/robots.md → src/guide/admin/clients.md
Original file line number Diff line number Diff line change
@@ -1,32 +1,32 @@
# Robots
# Clients
::: info Notice
In order to manage your identity-providers, nodes, ... you need to get an organization. Please contact us,
such we can provide you a realm in which you can manage all your nodes, users and identity providers.
For more details on realms click [here](/guide/admin/realms).
Comment on lines 3 to 5

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Tighten the realm notice.

This paragraph still leaves out clients and uses [here], so the updated Clients page and the linked realm docs stay aligned.

Suggested wording
- In order to manage your identity-providers, nodes, ... you need to get an organization. Please contact us,
- such we can provide you a realm in which you can manage all your nodes, users and identity providers.
- For more details on realms click [here](/guide/admin/realms).
+ In order to manage your identity-providers, clients, nodes, ... you need to get an organization. Please contact us,
+ so we can provide you a realm in which you can manage all your clients, nodes, users, and identity providers.
+ For more details on realms, see the [realms guide](/guide/admin/realms).
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
In order to manage your identity-providers, nodes, ... you need to get an organization. Please contact us,
such we can provide you a realm in which you can manage all your nodes, users and identity providers.
For more details on realms click [here](/guide/admin/realms).
In order to manage your identity-providers, clients, nodes, ... you need to get an organization. Please contact us,
so we can provide you a realm in which you can manage all your clients, nodes, users, and identity providers.
For more details on realms, see the [realms guide](/guide/admin/realms).
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)

[warning] 5-5: Link text should be descriptive

(MD059, descriptive-link-text)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/guide/admin/clients.md` around lines 3 - 5, The paragraph in
src/guide/admin/clients.md should be tightened to explicitly mention clients,
replace the vague "[here]" link text, and align with the realms doc; update the
sentence that currently reads "In order to manage your identity-providers,
nodes, ... you need to get an organization..." to a concise line that names
clients (e.g., "identity providers, nodes, clients, and users"), requests
contacting us to obtain a realm for management, and replace
"[here](/guide/admin/realms)" with explicit link text like "realm docs" (keeping
the same /guide/admin/realms URL) so the Clients page and the linked Realms
documentation stay aligned.

Source: Linters/SAST tools

:::
Robots may be freely created and edited by the admin. They are pseudo-users, which are handled directly
Clients may be freely created and edited by the admin. They are pseudo-users, which are handled directly
by the API, meaning that you will not be able to login in the central App with their credentials.
This allows for slightly faster automatized pipeline executions for the PHT's functions.
This allows for slightly faster automatized pipeline executions for the PHT's functions.

1. Within the admin area (top left), you need to select **Robots** within the left navigation.
1. Within the admin area (top left), you need to select **Clients** within the left navigation.
[![image](/images/ui_images/hub_robots.png)](/images/ui_images/hub_robots.png)
2. **View** existing robots (Optional: Use the search bar at the top).
3. **See/Edit details** for each robot by clicking the blue triple-bar button on the right.
Doing so shows the general description of the robot.
2. **View** existing clients (Optional: Use the search bar at the top).
3. **See/Edit details** for each client by clicking the blue triple-bar button on the right.
Doing so shows the general description of the client.
[![image](/images/ui_images/hub_robots_details.png)](/images/ui_images/hub_robots_details.png)
You may also specify realms of other users if you wish to make it accessible for them.\
You can furthermore specify the roles and associated permissions of the robot with the tabs on
top under its name to ensure it does not have any authorities beyond the ones necessary for its
You can furthermore specify the roles and associated permissions of the client with the tabs on
top under its name to ensure it does not have any authorities beyond the ones necessary for its
functionalities. For this, roles describe a rough outline specifically targeted at the admin's
own realm.\
[![image](/images/ui_images/hub_robots_roles.png)](/images/ui_images/hub_robots_roles.png)\
If the robot is shared though, it is useful to declare the underlying permissions in
If the client is shared though, it is useful to declare the underlying permissions in
order to ensure it is working in other realms as well (as the permissions of their roles may vary).\
[![image](/images/ui_images/hub_robots_permissions.png)](/images/ui_images/hub_robots_permissions.png)\
Adding either roles or permissions to the robot is done by clicking the green plus-symbol on the right.
Vice-versa, roles and permissions can be removed from the robot by clicking the red trashcan-button there.
4. **Delete** robots by clicking the red thrash can button on the right.
5. **Add** robots by clicking the grey plus button on the left of the overview. For this, a name and description of the
robot have to be given.
Adding either roles or permissions to the client is done by clicking the green plus-symbol on the right.
Vice-versa, roles and permissions can be removed from the client by clicking the red trashcan-button there.
4. **Delete** clients by clicking the red thrash can button on the right.
Comment thread
brucetony marked this conversation as resolved.
5. **Add** clients by clicking the grey plus button on the left of the overview. For this, a name and description of the
client have to be given.
[![image](/images/ui_images/hub_robots_add.png)](/images/ui_images/hub_robots_add.png)
Comment thread
brucetony marked this conversation as resolved.
6. **Refresh** this list anytime by clicking the black refresh button on the top right.
2 changes: 1 addition & 1 deletion src/guide/admin/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Administrators have the following tasks in FLAME, either in the central App or i
local node setup:

**`Hub`**
- [Realm-](/guide/admin/realms), [identity provider-](/guide/admin/identity-providers), [robot-](/guide/admin/robots), [user-](/guide/admin/users) & [role-management](/guide/admin/roles)
- [Realm-](/guide/admin/realms), [identity provider-](/guide/admin/identity-providers), [client-](/guide/admin/clients), [user-](/guide/admin/users) & [role-management](/guide/admin/roles)
- [Viewing and assigning permissions](/guide/admin/permissions)
- [Registering and managing the local node](/guide/admin/node-management)
- [Reviewing proposals](/guide/admin/project-review)
Expand Down
4 changes: 2 additions & 2 deletions src/guide/admin/realms.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Realms
Normal administrators can create realms freely after being assigned an initial realm. The developers of the [FLAME hub interface](https://privateaim.net)
provide these. Please contact us, such we can provide you with a realm in which you can manage all your
identity providers, robots, users, roles, and nodes.\
identity providers, clients, users, roles, and nodes.\
Realms are areas where those things are registered for one organization. You can access, view and manage all registered
items by activating a realm.\
Usually, you should only have access to the initial realm assigned to you and all other realms you created afterward.
Expand All @@ -17,5 +17,5 @@ Usually, you should only have access to the initial realm assigned to you and al
[![image](/images/ui_images/hub_realms_add.png)](/images/ui_images/hub_realms_add.png)
6. **Refresh** this list anytime by clicking the black refresh button on the top right.
7. **Activate** another realm than your current one by clicking the blue check button on the right.\
**Note:** This will change the contents in the "Identity Providers"-, "Robots"-, "Users"-, and "Roles"-tabs in the left
**Note:** This will change the contents in the "Identity Providers"-, "Clients"-, "Users"-, and "Roles"-tabs in the left
sidebar to the ones associated with the selected realm.
23 changes: 15 additions & 8 deletions src/guide/deployment/node-installation.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,9 @@ This section will provide instructions for deploying the FLAME node software on

**These instructions assume that you have done the following:**

- [Node has been registered in the Hub UI](./node-registration#creating-a-node-in-the-hub)
- [Credentials for your node's robot were generated and saved](./node-registration#client-credentials)
- [A keypair was generated](./node-registration#crypto) and the private key was saved as `private_key.pem`
- [Node has been registered in the Hub UI](./node-registration#creating-a-node-in-the-hub)
- [Credentials for your node's client were generated and saved](./node-registration#client-credentials)
- [A keypair was generated](./node-registration#crypto) and the private key was saved as `private_key.pem`

## Requirements

Expand Down Expand Up @@ -40,9 +40,9 @@ This label is required so that analysis pods can resolve internal service names
Kubernetes distributions — including microk8s, kubeadm, EKS, GKE, AKS, and k3s — use this label by default.
You can verify this with:

```bash
kubectl get pods -n kube-system -l k8s-app=kube-dns
```
```bash
kubectl get pods -n kube-system -l k8s-app=kube-dns
```

If this returns no pods, your DNS provider uses a non-standard label and network policy enforcement for analysis pods
will not work correctly.The following distributions have been tested for use with the Node software:
Expand All @@ -51,6 +51,8 @@ will not work correctly.The following distributions have been tested for use wit
- [minikube](https://minikube.sigs.k8s.io/docs/start/?arch=%2Fwindows%2Fx86-64%2Fstable%2F.exe+download)
- [Kubernetes](https://kubernetes.io/docs/setup/)

The FLAME Node is designed to work with an NGINX Ingress Controller. Compatibility with other Ingress Controllers is not guaranteed.
Comment thread
brucetony marked this conversation as resolved.

#### Helm

The FLAME Node software package is a compilation of multiple services working together which require several
Expand All @@ -67,8 +69,13 @@ In order to deploy a node, you will need the following pieces of information fro
2. Client Secret (not hashed!)
3. Private Key

With this information, you can either edit the `values.yaml` file included with the FLAME Node helm chart or create
your own values template file to be used during deployment. Here is a minimal example of a values file:
With this information, you can provide the required Helm configuration values in two ways:

If you are using the GitHub repository, a sample `values.yaml` file is included in the `charts/flame-node/` directory. It can be edited as needed. Alternatively, you may create a new `values.yaml` file.

If you are installing via the Helm repository, you need to create your own `values.yaml` file (e.g. `my-values.yaml`). This file is not provided automatically and can be stored anywhere locally. It is passed to Helm using the `-f` option.

Here is a minimal example of a `values.yaml` file:

```yaml
expose:
Expand Down
9 changes: 4 additions & 5 deletions src/guide/deployment/node-registration.md
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ node.

## Credentials for Deployment

Once the node is created, admins can access the "Robot" and "Crypto" tabs which contain needed credentials and keys
Once the node is created, admins can access the "Crypto" and "Client" tabs which contain needed credentials and keys
for deploying the node software on their server.

### Crypto
Expand All @@ -44,7 +44,7 @@ To encrypt data that needs to be sent between different nodes, each node needs a
to encrypt/decrypt the information. The "Crypto" tab allows the admin to generate a crytopgraphic key pair for this
purpose.

![Hub Crypto](/images/ui_images/hub_crypto.png)
![Hub Crypto](/images/ui_images/hub_node_crypto.png)

Navigate to the "Crypto" tab and click on the "Generate" button at the bottom of the window. A public and private key
pair will be generated. The user should copy the contents of the "PrivateKey" section to a **local file and save it**. We will need this key during installation and will no longer be accessible in your browser after you navigate away from the Crypto tab.
Expand All @@ -64,11 +64,10 @@ key used during deployment will not be from the same pair.
This page contains two pieces of information required for the deploying the FLAME Node: the client ID and secret.

Because the secret was automatically created when the node was registered and then hashed, we need to generate a new
one. Click the "generate" button below the secret text field to create a new secret and copy this string somewhere
for later. Then click "update" and you will see a green text box appear indicating that the client secret
one. Click the regenerate icon (two circular arrows) next to the secret text field to generate a new secret. Be sure to copy and save the generated string for future use. Then click "update" and you will see a green text box appear indicating that the client secret
for this node was successfully updated.

[![Getting Client Credentials](/images/ui_images/hub_node_robot_credentials.png)](/images/ui_images/hub_node_robot_credentials.png)
[![Getting Client Credentials](/images/ui_images/hub_client.png)](/images/ui_images/hub_client.png)

::: warning Don't Copy the Hashed Secret!
If you see "hashed" next to the word secret above the text field, this means the value in the box below is hashed and
Expand Down
Binary file added src/public/images/ui_images/hub_client.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added src/public/images/ui_images/hub_node_crypto.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading