Infrastructure Manager - Simple Graphical UI (based on INDIGO PaaS Orchestrator Dashboard)

Functionalities:

• OIDC authentication
• Display user's infrastructures
• Display infrastructure details, template and log
• Delete infrastructure
• Create new infrastructure

The im-dashboard is a Python application built with the Flask microframework; Flask-Dance is used for Openid-Connect/OAuth2 integration.

The docker image uses Gunicorn as WSGI HTTP server to serve the Flask Application.

Register a client in an OIDC server with the following properties:

• redirect uri: https://<DASHBOARD_HOST>:<PORT>/login/oidc/authorized
• scopes: 'openid', 'email', 'profile', 'offline_access' ('eduperson_entitlement' in EGI Check-In optional)
• introspection endpoint enabled

Create the config.json file (see the example) setting the following variables:

You need to run the IM dashboard on HTTPS (otherwise you will get an error); you can choose between

• enabling the HTTPS support
• using an HTTPS proxy

Details are provided in the next paragraphs.

The IM dashboard can exploit some optional information provided in the TOSCA templates for rendering the cards describing the type of applications/services or virtual infrastructure that a user can deploy.

In particular, the following tags are supported:

Example of template metadata:

tosca_definitions_version: tosca_simple_yaml_1_0

imports:
  - indigo_custom_types: https://raw.githubusercontent.com/indigo-dc/tosca-types/v4.0.0/custom_types.yaml

description: Deploy a Mesos Cluster (with Marathon and Chronos frameworks) on top of Virtual machines

metadata:
  display_name: Deploy a Mesos cluster
  icon: https://indigo-paas.cloud.ba.infn.it/public/images/apache-mesos-icon.png

topology_template:

....

You would need to provide

• a pair certificate/key that the container will read from the container paths /certs/cert.pem and /certs/key.pem;
• the environment variable ENABLE_HTTPS set to True

Run the docker container:

docker run -d -p 443:5001 --name='im-dashboard' \
           -e ENABLE_HTTPS=True \
           -v $PWD/cert.pem:/certs/cert.pem \
           -v $PWD/key.pem:/certs/key.pem \
           -v $PWD/config.json:/app/app/config.json \
           -v $PWD/tosca-templates:/opt/tosca-templates \
           grycap/im-dashboard:latest

Access the dashboard at https://<DASHBOARD_HOST>/

Example of configuration for nginx:

server {
      listen         80;
      server_name    YOUR_SERVER_NAME;
      return         301 https://$server_name$request_uri;
}

server {
  listen        443 ssl;
  server_name   YOUR_SERVER_NAME;
  access_log    /var/log/nginx/proxy-paas.access.log  combined;

  ssl on;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_certificate           /etc/nginx/cert.pem;
  ssl_certificate_key       /etc/nginx/key.pem;
  ssl_trusted_certificate   /etc/nginx/trusted_ca_cert.pem;

  location / {
                # Pass the request to Gunicorn
                proxy_pass http://127.0.0.1:5001/;

                proxy_set_header        X-Real-IP $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        X-Forwarded-Proto https;
                proxy_set_header        Host $http_host;
                proxy_redirect          http:// https://;
                proxy_buffering         off;
  }

}

Run the docker container:

docker run -d -p 5001:5001 --name='im-dashboard' \
           -v $PWD/config.json:/app/app/config.json \
           -v $PWD/tosca-templates:/opt/tosca-templates \
           grycap/im-dashboard:latest

⚠️ Remember to update the redirect uri in the OIDC client to https://<PROXY_HOST>/login/oidc/authorized

Access the dashboard at https://<PROXY_HOST>/

You can change the number of gunicorn worker processes using the environment variable WORKERS. E.g. if you want to use 2 workers, launch the container with the option -e WORKERS=2 Check the documentation for ideas on tuning this parameter.