org_admin features

[falibabaei]

Hello,
I am very new to the nvlfare framework and by reading the documentation and working with some examples I have some basic questions.
1- As a project admin can I start all the clients or must their org_admin start them?
2- In the documentation of nvflare 2.1 or higher it mentions that the admin of each organization can change the privacy and resource management of their own sites, but when I provision either through the dashboard or the CLI tools, the templates for these configurations are still on the server site. Why I do not have them in the org_admin kit
3- When provisioning through the dashboard, the org_admin can download the startup kits of their clients. It would be better if when using the CLI tool for deployment, each client startup kit would be in their org_admin folder.

[chesterxgchen]

If you are just play around with examples. You can play all the roles. So you can do everything.

Assume you are try to do in real production or simulate the production. Then you must respect different roles.

1- As a project admin can I start all the clients or must their org_admin start them?
Yes, if the project admin in the same or the client ( therefore, he is likely has the right of org_admin)
No, in general case, project_admin can't start for the client's system. This is done by client's org admin.
Imaging the following scenarios: Project Admin, who organize this FL coloration with with 3 hospitals.
Hospital 1 ( project Admin works at) host the server, Hospital 2,3 are the clients.
Proj admin from hospital 1 has no access to the IT or machines to the other hospitals. FL clients must be started by the org admins of hospital 1 and 2
2- In the documentation of nvflare 2.1 or higher it mentions that the admin of each organization can change the privacy and resource management of their own sites, but when I provision either through the dashboard or the CLI tools, the templates for these configurations are still on the server site. Why I do not have them in the org_admin kit
These are specified as local policy under startup kit. By default they are empty. As these are not determined by provision time. It is set later at each client site after the provisioning. you can read corresponding documents and examples to see how this is set: https://github.com/NVIDIA/NVFlare/tree/dev/examples/advanced/federated-policies

3- When provisioning through the dashboard, the org_admin can download the startup kits of their clients. It would be better if when using the CLI tool for deployment, each client startup kit would be in their org_admin folder.

No sure about that. The startup kits go for each client name (such as site-1, site-2), not for the org_admin.

[chesterxgchen]

This is not related to the provision ( project.yml), but the policy added by the clients. Please see examples iin https://github.com/NVIDIA/NVFlare/tree/dev/examples/advanced/federated-policies

[falibabaei]

Yes I understand about policy. I mean for the second one. Put the start up kits of the clients into the org-admin folder

[falibabaei]

I think, this way make the life of project admin easier 😁

[chesterxgchen]

what exactly it will look like ?

suppose I have participants

project_admin@site-1
org_admin1@site-1
org_admin2@site-2
site-1
site-2
server

when provision, will have startup_kit for each participant. are your suggesting to put site-1 under org_admin1@site-1 ? site-2 under org_admin2@site-2 ?

[falibabaei]

Yes, exactly. In this scenario, it might not seem necessary, but let's consider a situation where I am involved with 10 different organizations, and each of them possesses at least 3 sites. As the project administrator, my responsibility is to arrange and organize the files for each organization and subsequently send them to the corresponding organization administrator. Using the dashboard makes this task effortless, requiring no additional effort. However, should I choose not to create a dashboard, I'll have to handle more tasks manually.

[falibabaei]

Hi!
Can I run my server on a VM and the clients locally? If yes, on my VM I have already opened the ports for admin and server. How can I provision my project in this case? what do I need to add here?

• name: 193.196.39.134
  type: server
  org: nvidia
  fed_learn_port: 8102
  admin_port: 8103

[YuanTingHsieh]

How do you setup and run your VM?
Is it inside a "docker" in your local machine? If so, please refer to: https://nvflare.readthedocs.io/en/stable/getting_started.html#containerized-deployment-with-docker
Is it inside a cloud service provider (AWS, Azure, GCP)? If so, please refer to: https://nvflare.readthedocs.io/en/stable/real_world_fl/cloud_deployment.html

[chesterxgchen]

I have the same question, I am not clear what you trying to do.
Are you trying to create a VM (what VM?) inside a Host and then trying to simulate two clients on the Hosts itself ? why such setup ?

If you just want to experiment different docker containers representing server and clients in the same host (local host), you can do this directly in the 2.4.0 POC

nvflare poc --prepare -d <docker_image>

that will tell the local provision to use the docker_image in the builder and when poc start, it run as detached dockers for server and client.

[falibabaei]

never mind. I changed sp_end_point for overseer agent and it works now.