Disable BYOC

[mkhattat]

Hi everyone,

I am trying to deploy nvflare for production. I am using nvflare dashboard to generate startup kits for clients and project admin. Everything works fine. However, I want to prevent the project admin to run arbitrary code (when submitting a job) on client sites by default. From my understanding after reading the docs this should be the default behavior.

But currently, there is some custom code in the custom folder of the admin and they all will be run by clients without any problem. I would like the clients to reject accepting those codes and only run the code that is in the PYTHONPATH installed by themselves before joining the nvflare network. This is a way for clients to basically audit the code before even joining the network.

I saw some parameters like allow_byoc and enable_byoc but since I am using nvflare dashboard UI to generate startup kits, I am not sure how to use them with nvflare dashboard.

My current setup:
Project admin creates a project in the dashboard and freeze the project.
Project admin downloads the overseer startup kit to start the server and use flare console startup kit to submit a job.
Clients join the project and download their startup kit and use start.sh to join the server.

I appreciate any help.

[IsaacYangSLA]

The dashboard is designed for simplicity. Therefore, it hides lots of options from users. The provision cli and project.yml is more flexible. If you would like to set byoc limitation on certain client sites, you can change it directly in their startup kit. There should be a authorization.json.default in local folder. This file can be edited directly by the IT of that client site.

[YuanTingHsieh]

Hi @mkhattat

Thanks Isaac for the info on dashboard.

To disable BYOC, you can follow our instructions in https://nvflare.readthedocs.io/en/main/user_guide/security/identity_security.html#sample-policy-with-explanations

For example, if I am at site-1, and I want to disable ALL jobs that contain custom code, I can do the following:

$ tree workspace/example_project/prod_00/site-1/local
workspace/example_project/prod_00/site-1/local
├── authorization.json.default
├── log.config.default
├── privacy.json.sample
└── resources.json.default

I edit the file:

$ vim site-1/local/authorization.json.default

To the following:

{
  "format_version": "1.0",
  "permissions": {
    "project_admin": {
      "byoc": "none"
    },
    "org_admin": {
      "submit_job": "none",
      "clone_job": "none",
      "manage_job": "o:submitter",
      "download_job": "o:submitter",
      "view": "any",
      "operate": "o:site",
      "shell_commands": "o:site",
      "byoc": "none"
    },
    "lead": {
      "submit_job": "any",
      "clone_job": "n:submitter",
      "manage_job": "n:submitter",
      "download_job": "n:submitter",
      "view": "any",
      "operate": "o:site",
      "shell_commands": "o:site",
      "byoc": "none"
    },
    "member": {
      "view": "any",
      "byoc": "none"
    }
  }
}

You can do this to all the sites that want to disable BYOC

[mkhattat]

Thank you @IsaacYangSLA and @YuanTingHsieh. This solution is good enough for now. I hope, in the future, we can customize the dashboard.

I had tried this solution before and didn't work. What I was missing from authorization.json.default was the "project_admin": { "byoc": "none" }. Now everything works as expected.