Support connecting to flowstate bridge without ssh or port forwarding

[koonpeng]

This is initial work to make it easier for third party ROS developers to develop ROS-based HMIs for flowstate. This allows a local ROS node to subscribe to flowstate interfaces published by flowstate_ros_bridge.

To test:

Start a solution from flowstate portal.

Build and sideload new flowstate_ros_bridge:

src/sdk-ros/flowstate_ros_bridge/scripts/build_service_bundle.sh
inctl service install --cluster=$CLUSTER images/flowstate_ros_bridge.bundle.tar --org=$INTRINSIC_ORG

On the flowstate portal, add flowstate_ros_bridge service to the solution.

Build and run flowstate_credentials_proxy:

rosdep install --from-paths src/sdk-ros/flowstate_credentials_proxy
colcon build--packages-up-to flowstate_credentials_proxy
ros2 run flowstate_credentials_proxy credentials_proxy --org=$INTRINSIC_ORG --cluster=$CLUSTER --service=$SERVICE_INSTANCE_NAME

Start rmw_zenohd, telling it to connect to the local proxy.

export ZENOH_CONFIG_OVERRIDE='connect/endpoints=["ws/localhost:7448"];routing/router/peers_failover_brokering=true'
ros2 run rmw_zenoh_cpp rmw_zenohd

Try subscribing to flowstate topics

export RMW_IMPLEMENTATION=rmw_zenoh_cpp
ros2 daemon stop
ros2 topic echo /tf

How it works

The updated flowstate_ros_bridge listens on websocket on a port given by flowstate in the runtime context. If enabled in a project, flowstate will forward connections to www.endpoints.{project}.cloud.goog/onprem/client/{cluster}/api/resourceinstances/{service} to the service. This allows HMIs to connect to flowstate without being on the same LAN or using ssh/port-forwarding.

However, the endpoints exposed by flowstate is protected, we cannot connect zenoh directly to it as it does not support flowstate authentication. flowstate_credentials_proxy starts a websocket proxy that injects the correct auth token.

Caveats

• Exposing service assets outside flowstate is an experimental feature and is not in production yet.
• Only rmw_zenoh_cpp is supported and it must connect to the local proxy.
• Bandwidth and latency will be affected.

Next Steps

• Automatically add the service to the solution.
• Experiment with moving flowstate_ros_bridge to local side, we will use the service assets to expose a subset of intrinsic pubsub instead. This should allow all rmw to be supported.
  • flowstate_ros_bridge will do everything flowstate_credentials_proxy is doing and publish on flowstate interfaces.