search

coiled / feedback

A place to provide Coiled feedback
14 stars 3 forks source link

The Dask dashboard is publicly available #93

Closed rubenvdg closed 1 year ago

rubenvdg commented 3 years ago

I was surprised to see that the Dask dashboard (cluster.dashboard_link) is publicly available. Isn't this undesirable from a security perspective?

Side note: Thanks for making the beta freeliy available!

christianacromer commented 3 years ago

Hey Ruben - so glad you're enjoying our free beta! Just wanted to let you know that response times over the holidays from our engineering team will a bit slower than usual, but someone should get back to you within the next few days and answer your question. Thanks so much!

mrocklin commented 3 years ago

Yes, this is a valid point. The dashboard itself doesn't offer any control over the cluster or the data managed by the cluster, but it does offer a window into what is going on. It is reasonable to not want it to be publicly accessible.

We also offer an authenticated/proxied route to the dashboard, and we can switch things over if we need to (we'll eventually need to) but we're not currently doing this because these authenticated routes don't work well with the Dask-JupyterLab extension, which doesn't authenticate in the same way. cc @ian-r-rose , who may be able to think of a good solution here.

ian-r-rose commented 3 years ago

I think it would be worth thinking of how to make the dask-labextension authentication-aware. A couple of possible ways forward:

IFrame urls

  1. The client dashboard info includes some sort of token-based auth information (using a tornado auth module?)
  2. This information is used to construct the iframe urls which are embedded in JLab.

Fully proxied dashboard

  1. The client dashboard includes the same auth information as above
  2. The server component of the dask-labextension fully proxies the dashboard (rather than providing the unaltered dashboard URLs), authenticating in the process. This would bring user-provided dashboard URLs into the same proxying mechanism as those launched with the cluster manager.

I think both options are reasonable, and, in fact, might be preferable in different circumstances, so I'd probably want to make it configurable.

shughes-uk commented 1 year ago

Fully resolved by @ntabris , authentication and https. Woo!!