text: (window.webpackJsonp=window.webpackJsonp||[]).push([[113],{166:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return s})),a.d(t,"metadata",(function(){return l})),a.d(t,"rightToc",(function(){return o})),a.d(t,"default",(function(){return p}));var n=a(2),i=a(6),r=(a(0),a(300)),s={title:"Basic Concepts",slug:"/enterprise/basic-concepts"},l={unversionedId:"enterprise/basic-concepts",id:"enterprise/basic-concepts",isDocsHomePage:!1,title:"Basic Concepts",description:"H2O AI Cloud platform recognizes three actors:",source:"@site/docs/enterprise/basic-concepts.md",slug:"/enterprise/basic-concepts",permalink:"/wave/docs/enterprise/basic-concepts",editUrl:"https://github.com/h2oai/wave/edit/master/website/docs/enterprise/basic-concepts.md",version:"current",sidebar:"someSidebar",previous:{title:"Introduction",permalink:"/wave/docs/enterprise/"},next:{title:"Developer Guide",permalink:"/wave/docs/enterprise/developer-guide"}},o=[{value:"App",id:"app",children:[]},{value:"App Instance",id:"app-instance",children:[]},{value:"App Tag",id:"app-tag",children:[]},{value:"Authorization",id:"authorization",children:[{value:"App Authorization for Users with Full Access",id:"app-authorization-for-users-with-full-access",children:[]},{value:"Instance Authorization for Users with Full Access",id:"instance-authorization-for-users-with-full-access",children:[]},{value:"Tag Authorization for Users with Full Access",id:"tag-authorization-for-users-with-full-access",children:[]},{value:"Authorization for Visitors",id:"authorization-for-visitors",children:[]},{value:"Authorization for Admins",id:"authorization-for-admins",children:[]}]}],c={rightToc:o};function p(e){var t=e.components,a=Object(i.a)(e,["components"]);return Object(r.b)("wrapper",Object(n.a)({},c,a,{components:t,mdxType:"MDXLayout"}),Object(r.b)("p",null,"H2O AI Cloud platform recognizes three actors:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"App Developer"),": creates and publishes apps"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"App User"),': browses and runs apps, can be either user with "full access" or visitor'),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Admin"),": manages the platform")),Object(r.b)("p",null,"over three resource types:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"App"),": runnable Wave app package"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"App instance"),": running instance of an app"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"App tag"),": label for categorizing apps withing the platform")),Object(r.b)("h2",{id:"app"},"App"),Object(r.b)("p",null,"App is a runnable Wave app package with metadata, such as (grouped into categories):"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Identity",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"a unique name and version identifier"))),Object(r.b)("li",{parentName:"ul"},"Display/search",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"a title and description"),Object(r.b)("li",{parentName:"ul"},"icon and screenshots"),Object(r.b)("li",{parentName:"ul"},"search category and keywords"))),Object(r.b)("li",{parentName:"ul"},"Authorization",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"owner (i.e., the person who imported it into H2O AI Cloud)"),Object(r.b)("li",{parentName:"ul"},"visibility (",Object(r.b)("inlineCode",{parentName:"li"},"PRIVATE"),", ",Object(r.b)("inlineCode",{parentName:"li"},"ALL_USERS"),")"))),Object(r.b)("li",{parentName:"ul"},"Runtime",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"RAM/disk requirements"),Object(r.b)("li",{parentName:"ul"},"other runtime settings (e.g., pointers to dependencies and secrets to be injected at startup time)")))),Object(r.b)("p",null,"Users can start/run multiple instances of each app (subject to authorization, see below)."),Object(r.b)("p",null,"Apps are mostly ",Object(r.b)("strong",{parentName:"p"},"immutable"),', meaning once uploaded, they cannot be changed (except for visibility).\nTo "update" an app, one has to upload a new version. This is to simplify the app lifecycle\nand remove the need for developers to address app upgrade/downgrade.'),Object(r.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(r.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(r.b)("h5",{parentName:"div"},Object(r.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(r.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(r.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(r.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(r.b)("p",{parentName:"div"},"Internally, H2O AI Cloud treats every app name/version combination as a separate entity.\nThe UI then uses the app name to link several versions together; however each can have different\ntitle, description, owner, instances, etc."))),Object(r.b)("h2",{id:"app-instance"},"App Instance"),Object(r.b)("p",null,"App instance is a running instance of an app with the following metadata:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"pointer to the corresponding app"),Object(r.b)("li",{parentName:"ul"},"owner (the person who started it)"),Object(r.b)("li",{parentName:"ul"},"visibility (",Object(r.b)("inlineCode",{parentName:"li"},"PRIVATE"),", ",Object(r.b)("inlineCode",{parentName:"li"},"ALL_USERS"),", ",Object(r.b)("inlineCode",{parentName:"li"},"PUBLIC"),")")),Object(r.b)("p",null,"H2O AI Cloud fully manages the app instance lifecycle on behalf of its users."),Object(r.b)("p",null,"Instances can be stateless or stateful (depending on the app configuration)\nand can use external dependencies (e.g., AWS S3, Driverless AI)."),Object(r.b)("p",null,"Under the hood, each instance consists of several k8s resources, specifically, each instance is running in its\nown k8s ",Object(r.b)("inlineCode",{parentName:"p"},"pod"),", under its own k8s ",Object(r.b)("inlineCode",{parentName:"p"},"service"),", accessible via a H2O AI Cloud subdomain (e.g., ",Object(r.b)("inlineCode",{parentName:"p"},"https://1234.wave.h2o.ai"),").\nIt can optionally include other resources, such as PVCs, Configmaps, etc."),Object(r.b)("h2",{id:"app-tag"},"App Tag"),Object(r.b)("p",null,"Tags are means of annotating apps in the platform (similar to\n",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"https://docs.github.com/en/free-pro-team@latest/github/managing-your-work-on-github/about-labels"}),"GitHub issue labels"),').\nBeyond visually categorizing apps, tags also act as a mechanism by which apps are exposed to "visitors" (i.e., users without "full access");\nsee ',Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#authorization-for-visitors"}),"Authorization for Visitors")," for details."),Object(r.b)("p",null,"Tags are standalone resources with the following metadata (grouped into categories):"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Display/search properties",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"name, title, color, description"))),Object(r.b)("li",{parentName:"ul"},"ACLs",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"admin roles (i.e., the users that can manage the tag)"),Object(r.b)("li",{parentName:"ul"},"visitor roles  (i.e., the visitors that can view apps with this tag)")))),Object(r.b)("p",null,"Tags are assigned to apps individually, each tag can be assigned to multiple apps, each app can\nhave multiple tags assigned."),Object(r.b)("h2",{id:"authorization"},"Authorization"),Object(r.b)("p",null,'Authorization rules differ depending on the role of a user, distinguishing between users with "full access",\nvisitors (users without "full access"), and admins.'),Object(r.b)("h3",{id:"app-authorization-for-users-with-full-access"},"App Authorization for Users with Full Access"),Object(r.b)("p",null,"Access to apps is governed by the following rules:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"PRIVATE")," apps are only visible to/runnable by the owner;\nthese are typically experimental versions created via ",Object(r.b)("inlineCode",{parentName:"li"},"h2o bundle deploy")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"ALL_USERS"),' apps are visible to/runnable by all signed-in users with "full access"; they are also visible on the "Catalog" page;\nthese are typically created via ',Object(r.b)("inlineCode",{parentName:"li"},"h2o bundle import")),Object(r.b)("li",{parentName:"ul"},"The app owner can manage (view, update, delete) her apps via ",Object(r.b)("inlineCode",{parentName:"li"},"h2o app ..."),' or via the "My Apps" page'),Object(r.b)("li",{parentName:"ul"},'Any user with "full access" can import new apps into the platform via ',Object(r.b)("inlineCode",{parentName:"li"},"h2o ..."))),Object(r.b)("p",null,"See ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"developer-guide#cli"}),"Developer Guide")," for details on managing apps."),Object(r.b)("h3",{id:"instance-authorization-for-users-with-full-access"},"Instance Authorization for Users with Full Access"),Object(r.b)("p",null,"Access to app instances is governed by the following rules:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"PRIVATE")," instances are only visible to the owner (and to an extent to the owner of the corresponding app, see below for details)"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"ALL_USERS"),' instances are visible to all signed-in users with "full access"'),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"PUBLIC")," instances are visible to anyone on the Internet"),Object(r.b)("li",{parentName:"ul"},"The instance owner can manage (view, update, terminate, see status/logs of) her instances via ",Object(r.b)("inlineCode",{parentName:"li"},"h2o instance"),' or via the "My instances" page'),Object(r.b)("li",{parentName:"ul"},"App owner can see metadata, status, and logs of her app's instances via ",Object(r.b)("inlineCode",{parentName:"li"},"h2o instance")," or via the app detail page\nregardless of instance visibility; this is to facilitate troubleshooting;\nnote that this does not include access to the app UI itself or any write access")),Object(r.b)("p",null,"Note that app/instance visibility can be modified by the owner, e.g., using ",Object(r.b)("inlineCode",{parentName:"p"},"h2o (app|instance) update <id> -v <visibility>"),'\nor via the "My Apps"/"My Instances" page.'),Object(r.b)("p",null,"See ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"developer-guide#cli"}),"Developer Guide")," for details on managing app instances."),Object(r.b)("h3",{id:"tag-authorization-for-users-with-full-access"},"Tag Authorization for Users with Full Access"),Object(r.b)("p",null,"Access to tags is governed by the following rules:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},'All users with "full access" can see all tags and tag assignments'),Object(r.b)("li",{parentName:"ul"},"A tag can only be assigned/removed/updated by users having a role (as determined by the auth provider)\nthat is present in the tag's ",Object(r.b)("inlineCode",{parentName:"li"},"Admin Roles"),' list; empty means any user with "full access" is allowed'),Object(r.b)("li",{parentName:"ul"},"Currently, tags can only be created by admins")),Object(r.b)("p",null,"See ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"developer-guide#managing-app-tags"}),"Developer Guide")," for details on managing tags."),Object(r.b)("h3",{id:"authorization-for-visitors"},"Authorization for Visitors"),Object(r.b)("p",null,'Visitors, a.k.a., users without "full access", have limited permissions within the platform:'),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Visitors can only ever see their own instances, regardless of instance visibility (technically,\nthey can also access UI of the ",Object(r.b)("inlineCode",{parentName:"li"},"PUBLIC")," instances, if given the URL)"),Object(r.b)("li",{parentName:"ul"},"Visitors cannot see app logs, not even for their own instances  "),Object(r.b)("li",{parentName:"ul"},"Visitors cannot import apps into the platform"),Object(r.b)("li",{parentName:"ul"},"Visitors can only see/run ",Object(r.b)("inlineCode",{parentName:"li"},"ALL_USERS")," apps that have a tag which includes one of the visitor's roles\n(as determined by the auth provider) in the tag's ",Object(r.b)("inlineCode",{parentName:"li"},"Visitor Roles"),"; empty means no visitors are allowed",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},Object(r.b)("em",{parentName:"li"},"Example"),": Visitor ",Object(r.b)("inlineCode",{parentName:"li"},"UA")," has role ",Object(r.b)("inlineCode",{parentName:"li"},"RA"),", visitor ",Object(r.b)("inlineCode",{parentName:"li"},"UB")," has role ",Object(r.b)("inlineCode",{parentName:"li"},"RB"),", tag ",Object(r.b)("inlineCode",{parentName:"li"},"TA")," has ",Object(r.b)("inlineCode",{parentName:"li"},"Visitor Roles")," ",Object(r.b)("inlineCode",{parentName:"li"},"RA, RC"),", tag\n",Object(r.b)("inlineCode",{parentName:"li"},"TB")," has ",Object(r.b)("inlineCode",{parentName:"li"},"Visitor Roles")," ",Object(r.b)("inlineCode",{parentName:"li"},"RB"),", app ",Object(r.b)("inlineCode",{parentName:"li"},"A1")," has no tags, app ",Object(r.b)("inlineCode",{parentName:"li"},"A2")," has tag ",Object(r.b)("inlineCode",{parentName:"li"},"TA"),", app ",Object(r.b)("inlineCode",{parentName:"li"},"A3")," has tags ",Object(r.b)("inlineCode",{parentName:"li"},"TA, TB")," but is ",Object(r.b)("inlineCode",{parentName:"li"},"PRIVATE"),".\nIn this case, user ",Object(r.b)("inlineCode",{parentName:"li"},"UA")," can see and run app ",Object(r.b)("inlineCode",{parentName:"li"},"A2"),", while ",Object(r.b)("inlineCode",{parentName:"li"},"UB")," cannot see or run any apps."))),Object(r.b)("li",{parentName:"ul"},"Visitors cannot see tags or tag assignments")),Object(r.b)("h3",{id:"authorization-for-admins"},"Authorization for Admins"),Object(r.b)("p",null,"The admin API gives admins read/write access to all apps/instances/tags.\nNote that the admin API does not allow access to the app UI itself, meaning admins cannot access UI of ",Object(r.b)("inlineCode",{parentName:"p"},"PRIVATE")," instances.\nSimilarly, admins cannot impersonate another user, e.g., for the purposes of importing/running an app."))}p.isMDXComponent=!0},300:function(e,t,a){"use strict";a.d(t,"a",(function(){return b})),a.d(t,"b",(function(){return m}));var n=a(0),i=a.n(n);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function s(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function l(e){for(var t=1;t<arguments.length;t++){var a=null!=arguments[t]?arguments[t]:{};t%2?s(Object(a),!0).forEach((function(t){r(e,t,a[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):s(Object(a)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(a,t))}))}return e}function o(e,t){if(null==e)return{};var a,n,i=function(e,t){if(null==e)return{};var a,n,i={},r=Object.keys(e);for(n=0;n<r.length;n++)a=r[n],t.indexOf(a)>=0||(i[a]=e[a]);return i}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(n=0;n<r.length;n++)a=r[n],t.indexOf(a)>=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(i[a]=e[a])}return i}var c=i.a.createContext({}),p=function(e){var t=i.a.useContext(c),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},b=function(e){var t=p(e.components);return i.a.createElement(c.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return i.a.createElement(i.a.Fragment,{},t)}},d=i.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,r=e.originalType,s=e.parentName,c=o(e,["components","mdxType","originalType","parentName"]),b=p(a),d=n,m=b["".concat(s,".").concat(d)]||b[d]||u[d]||r;return a?i.a.createElement(m,l(l({ref:t},c),{},{components:a})):i.a.createElement(m,l({ref:t},c))}));function m(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var r=a.length,s=new Array(r);s[0]=d;var l={};for(var o in t)hasOwnProperty.call(t,o)&&(l[o]=t[o]);l.originalType=e,l.mdxType="string"==typeof e?e:n,s[1]=l;for(var c=2;c<r;c++)s[c]=a[c];return i.a.createElement.apply(null,s)}return i.a.createElement.apply(null,a)}d.displayName="MDXCreateElement"}}]);