Read-Only dashboard from raft cluster using SQLite

[nickdelnano]

Hi, I am interested in running orchestrator using raft with SQLite and would like to have both a read-write and a read-only dashboard. I have seen #408 and verified myself that web requests sent to a non-leader node are proxied to the leader. I was hoping to use the 404 response from the /api/leader-check endpoint to discover hosts offering a read-only dashboard.

I am interested in having both a read-write and read-only UI for access by different audiences. Given the feature above, I do not think I can use a non-leader node to expose a read-only UI. I have two other ideas of how this could be done:

1. Run a separate orchestrator instance which is constantly rediscovering all of the nodes in my topology to pick up updates
2. Run a separate orchestrator instance whose sqlite db file is constantly being replaced with the file contents from a node in the raft cluster

I dislike both of these ideas as they require extra processes outside of the raft cluster, and because HA of the read-only dashboard is not implied by HA of the raft cluster itself. Number one from above also requires additional MySQL connections to each of my servers.

Is there a recommendation for exposing a read-only dashboard from a raft cluster?

[shlomi-noach]

The method you're describing is hackish; I suggest using the existing security configuration. For example, use "AuthenticationMethod": "multi", see https://github.com/github/orchestrator/blob/master/docs/security.md

[nickdelnano]

Thank you!