Changes between Version 3 and Version 4 of FeddConfigExamples

Timestamp:

Dec 11, 2008 2:08:30 PM (15 years ago)

Author:

faber

Comment:

--

FeddConfigExamples

@@ -120 +120 @@
 In this case two `fedd`s are running.  The one on users accepts and evaluates access requests but calls out to the `fedd` on boss to do the manipulation of local testbed state.  Boss may choose to firewall all other hosts (except users) away from the fedd port, though the    `fedd` access controls will also protect access.  The situation looks like this:
 
+[[Image(2fedds.png)]]
+
+The configuration file on users looks like:
+
+{{{
+[globals]
+# Identify this fedd by the fedid encoded as a certificate file (user file protections to protect it)
+cert_file: /usr/local/etc/fedd/fedd.pem
+# Provide service on port 23235
+services: 23235
+
+[access]
+# Keep access state (which experiments are live) in this file
+# Be sure it is writeable by the fedd user
+access_state: /var/db/fedd/deter_access.state
+
+# Parameters for remote fedds to instantiate experiments
+boss: boss
+ops: users
+domain: .isi.deterlab.net
+fileserver: fs
+eventserver: event-server
+
+# This machine's URI to discriminate proxy requests (NB: this runs on users)
+testbed: https://users.isi.deterlab.net:23235
+
+# The database that maps requester to local access projects (shown below)
+accessdb: /usr/local/etc/fedd/deter_access
+
+[allocate]
+# Contact boss for allocations
+uri: https://boss.ucb.deterlab.net:23235
+
+}}}
+
+In addition the [FeddDatabases#AccessComponentAccessDB access component accessdb] in `/usr/local/etc/fedd/deter_access` might be similar to the following.  Note that the users `fedd` contains all the information to make the decisions about access.
+
+{{{
+# Overrides for the connector image and type
+attribute: connectorImage value: FBSD7-TVF
+attribute: connectorType value: pc3000_tunnel
+
+# Nodes of this type are not generally accessible
+restricted: rpc_3000
+
+# Additional keys may be added to these groups.  Note that when a user with emulab-ops as the project in their 
+# three-level name accesses the testbed, the fedd project will be given access to the restricted node type 
+# rpc_3000.  Requesters with Deter as the project will be unable to successfully request access to such nodes.
+(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, Deter, <any>) -> (Federation, fedd, <same>)
+(fedid:ce90957dd5b7d20f9c3890c4599313b7f1cf31ea, emulab-ops, <any>) -> (Federation, fedd:rpc_3000, <same>)
+
+}}}
+