Technical Lexicon
Below are concepts and terms utilized throughout the Margo Specification along with their associated description/definition.
Concepts
Interoperability
Interoperability is an overloaded term that has different meanings depending on the context. For Margo, interoperability is about achieving the following:
- Defining a common approach for packaging Components so they can be deployed as Workloads to any compatible Margo-compliant Edge Compute Devices via any Margo-compliant Workload Fleet Manager.
- Defining a common approach for packaging device software and firmware updates so they can be deployed to any Margo-compliant Edge Compute Devices via any Margo-compliant Device Fleet Manager.
- Defining a common API to enable communication between any Margo-compliant Edge Compute Devices and any Margo-compliant fleet management software.
- Defining a common approach for collecting and transmitting diagnostics and observability data from a Margo-compliant Edge Compute Device
Orchestration
Orchestration is an overloaded term that has different meanings depending on the context. For Margo, orchestration is about the deployment of Workloads and device software updates to Margo-compliant Edge Compute Devices via Margo-compliant fleet management software. Margo depends on container orchestration platforms such as Kubernetes, Docker and Podman existing on the Edge Compute Devices and is not an attempt to duplicate what these platforms provide.
Fleet Management
Fleet Management represents a concept or pattern that enables users to manage one to many set of workloads and devices the customer owns. Many strategies exist within fleet management such as canary deployments, rolling deployments, and many others. Below are two fleet management concepts that have been adopted by Margo.
State Seeking
The state seeking methodology, adopted via Margo, is enabled first by the Workload Fleet Manager when it establishes the "Desired state". The Edge Device then reconciles it's "Current state" with the "Desired state" provided by the Fleet Manager and reports the status.
Provider Model
The provider model within Margo describes a service that is able to orchestrate or implement the desired state within the Edge Device. Current providers supported:
- Helm Client
- Compose Client
Technical Terms
Application
An application is a collection of one, or more, Components, as defined by an Application Description, and bundled within an Application Package.
Application Package
An Application Package is used to distribute an application. The parts of an Application Package are: Application Description (that refers to contained and deployable Components) as well as associated resources (e.g., icons). While the application package is made available in an Application Registry, the referenced components are stored in a Component Registry, and the linked containers are provided via a OCI Container Image Registry.
Component
A Component is a piece of software tailored to be deployed within a customer's environment on an Edge Compute Device. Currently Margo-supported components are:
- Helm Chart
- Compose Archive
Compose Archive
A Compose Archive is a tarball file containing the Compose file, compose.yaml, which is formatted according the Compose specification, and any additional artifacts referenced by the Compose file (e.g., configuration files, environment variable files, etc.).
Workload
A Workload is an instance of a Component running within a customer's environment on a Edge Compute Device.
Edge Compute Device
Edge Compute Devices are represented by compute hardware that runs within the customer's environment to enable the system with Margo Compliant Workloads. Edge Compute Devices host the Margo compliant management agents, container orchestration platform, and device operating systems. Margo Edge Compute Devices are defined by the capabilities they provide within the Margo Architecture.
Workload Fleet Manager
Workload Fleet Manager (WFM) represents a software offering that enables End Users to configure, deploy, and manage edge Workloads as a fleet on their registered Edge Devices.
Workload Fleet Management Client
The Workload Fleet Management client is a service that runs on the Edge Compute Device which communicates with the Workload Fleet Manager to receive Components that will be instantiated as Workloads and configurations to be applied on the Edge Compute Device.
Device Fleet Manager
Device Fleet Manager (DFM) represents a software offering that enables End Users to onboard, delete, and maintain Edge Compute Devices within the ecosystem. This software is utilized in conjunction with the Workload Fleet Manager software to provide users with the features required to manage their Edge Device along with Workloads running on them.
Note: The Device Fleet Manager is a future component of the Margo specification. This section will be expanded as the community defines device management functionality.
Application Registry
An Application Registry hosts Application Packages that define, through their Application Description, the application as one or multiple Components. It is used by application developers to make their applications available. The API of the Application Registry is compliant with the OCI Registry API (v1.1.0).
Application Catalog
An Application Catalog is a visual representation of preselected, install-ready applications, the user of the WFM can deploy to it's managed Edge Compute Devices. Application Catalogs and how they function within the WFM are out of scope for Margo.
Component Registry
A Component Registry holds Components (e.g., Helm Charts and Compose Archives) for Application Packages. When an application gets deployed through a Workload Fleet Manager, the components (linked within an Application Description) are requested from the Component Registry and then deployed as workloads. Components link to containers that are typically provided through Container Registries. The Component Registry can be implemented, e.g., as an OCI Registry.
Container Image Registry
A Container Image Registry hosts container images. Components which are provided as Helm Charts or Compose Archives link to such container images.
Identity Terms
The following terms belong to the Margo Identity and Authorization Framework (MIAF), Margo's common foundation for identity, authentication, and authorization. MIAF builds on the open SPIFFE standard. The entries below are informative summaries; the authoritative definitions are in the MIAF terminology.
Trust Domain
A governed security boundary within which identities are issued and mutually recognized: it defines the trust anchors, the identity namespace, and the policies that govern them. Defined in the MIAF terminology.
SPIFFE ID
A URI of the form spiffe://<trust-domain>/<path> that names an identity within a Trust Domain. Defined in the MIAF terminology.
SVID
A SPIFFE Verifiable Identity Document: the verifiable credential representing an identity within a Trust Domain, which a component presents when it authenticates over mutual TLS. Defined in the MIAF terminology.
Trust Bundle
The set of X.509 trust anchors a Trust Domain publishes so that verifiers can validate SVIDs issued within the domain. Defined in the MIAF terminology.
Margo Identity Service
The identity-authority role within a Trust Domain, abbreviated MIS: it issues SVIDs and publishes the Trust Bundle and discovery document, and is defined by these responsibilities rather than by a specific product. Defined in the MIAF terminology.
Principal
A non-human Margo component that holds, or is being provisioned with, an identity in a Trust Domain; an Edge Compute Device participates through the WFM Client it hosts. Defined in the MIAF terminology.
WFM Identity
The identity of a Workload Fleet Manager within its Trust Domain. It anchors the namespace under which that WFM's client identities are issued. The naming rules are in the WFM Identity Profile.
WFM Client Identity
The identity of a WFM Client relationship within a Trust Domain, named under the WFM that issues it. The naming rules are in the WFM Identity Profile.