Add simplified enrollment system design spec#4197
Open
chesterxgchen wants to merge 4 commits intoNVIDIA:mainfrom
Open
Add simplified enrollment system design spec#4197chesterxgchen wants to merge 4 commits intoNVIDIA:mainfrom
chesterxgchen wants to merge 4 commits intoNVIDIA:mainfrom
Conversation
Comprehensive design document for FLARE simplified enrollment system covering two CSR-based workflows: - Manual Workflow (5-10 participants): Site Admin generates private key + CSR locally, Project Admin signs and returns cert + Server URI. Private keys never leave the site. No infrastructure required. - Auto-Scale Workflow (10+ participants): Same CSR model, automated via Certificate Service + enrollment tokens. Tokens authorize automatic CSR signing. Trade-off: requires Certificate Service deployment. Includes CLI command specs (nvflare cert csr/sign/init, nvflare token, nvflare package), K8s deployment examples with Secret Store patterns, security analysis, approval policies, and implementation details.
Contributor
Greptile SummaryThis PR adds a comprehensive design specification for NVIDIA FLARE's simplified enrollment system. The document proposes replacing the centralized provisioning model with two CSR-based workflows where private keys are always generated locally and never transmitted: Key changes:
The document is well-structured with clear workflow tables, code examples, architecture diagrams (ASCII), and comprehensive security considerations. All CLI commands appear consistent across sections, K8s manifests are syntactically correct, and the design maintains backward compatibility with existing provisioning workflows. Confidence Score: 5/5
Important Files Changed
Last reviewed commit: 4802ac7 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
- Add rootCA.pem to concerns table and complexity comparison for Manual Workflow deliverables - Standardize Org Admin -> Site Admin terminology throughout - Fix PostgreSQL schema to match SQLite: enrolled_sites -> enrolled_entities, site_name -> name, participant_type -> entity_type - Add Trust Model note clarifying Manual (Project Admin holds root CA key) vs Auto-Scale (Certificate Service holds root CA key) - Replace remaining bare env var K8s examples with Secret-based patterns - Fix typos: 365\) -> 365), enrollment.token -> enrollment_token - Fix grammar: Flare Dashboard run-on sentence
…re diagram - Convert RST-style blocks to proper Markdown (code fences, bold labels) - Fix HTTP API section with clean Request/Response and json blocks - Fix Admin CLI, Configuration YAML, CertServiceApp/Starting/Recommended code blocks - Fix Client/Server Auto-Enrollment Flow and Helper Functions Python blocks - Fix SQLiteEnrollmentStore section (SELECT *, escapes, **keyword**) - Redraw token-based enrollment architecture diagram (ASCII, PROJECT ADMIN -> Certificate Service -> FL Server/Clients) - Normalize list bullets and remove duplicate code fences
- Diagram: align CERTIFICATE SERVICE box, CertService line, add spaces around mTLS arrow - Normalize list bullets (* to -) in PKI and When to use separate keys - Rewrite Policy Elements section from RST-style to clean Markdown lists - Add colon to Design goals addressed for consistency with Key Benefits
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a comprehensive design document (
docs/design/enrollment_design.md) for FLARE's simplified enrollment system. This replaces the centralized provisioning model with two CSR-based workflows where private keys are always generated locally and never transmitted.Manual Workflow (5-10 participants)
nvflare packageAuto-Scale Workflow (10+ participants)
Document contents
nvflare cert csr,nvflare cert sign,nvflare cert init,nvflare token,nvflare packageTest plan