Deployment and isolation of plugins in a virtualized computing environment
In an architecture of a virtualized computing system plugins are less tightly integrated with a core user interface of a management server. Rather than being installed and executed at the management server as local plugins, the plugins are served as remote plugins from a plugin server, and may be accessed by a web client through a reverse proxy at the management server. Plugin operations may be executed at the plugin server and/or invoked from a user device where the web client resides. Furthermore, a plugin sandbox and other isolation configurations are provided at the user device, so as to further control access capability and interaction of the plugins.
1. A method to operate plugins in a virtualized computing environment, the method comprising:
installing the plugins at a plugin server remote from a management server for the virtualized computing environment, for execution remotely from the management server;
loading, via a first port of a reverse proxy of the management server and into a user interface of a web client, elements of a core user interface from the management server;
loading, via a second port of the reverse proxy of the management server and into the user interface of the web client, elements of a first plugin from the plugin server;
isolating at least some of the loaded elements of the first plugin from the core user interface;
loading, via the second port of the reverse proxy of the management server and into the user interface of the web client, elements of a second plugin from the plugin server; and
isolating the loaded elements of the first plugin from the loaded elements of the second plugin, wherein isolating the loaded elements of the first plugin from the loaded elements of the second plugin includes:
loading the elements of the first plugin into a first iframe; and
loading the elements of the second plugin into a second iframe, and
wherein the web client executes the first and second plugins remotely from the management server.
2. The method of claim 1 , wherein:
the first iframe is associated with a first shadow document object model (shadow DOM); and
the second iframe is associated with a second shadow document object model (shadow DOM) different from the first shadow DOM.
3. The method of claim 2 , wherein the first iframe, the first shadow DOM, the second iframe, and the second shadow DOM are associated with a common plugin sandbox at the web client.
4. The method of claim 1 , further comprising registering the plugins installed at the plugin server with an extension manager of the management server.
5. The method of claim 1 , wherein forwarding/redirection rules to the plugin server are registered with the reverse proxy.
6. The method of claim 1 , wherein the elements of the first plugin include user interface elements that extend functionality of the core user interface.
7. A non-transitory computer-readable medium having instructions stored thereon, which in response to execution by one or more processors, cause the one or more processors to perform or control performance of operations that pertain to plugins in a virtualized computing environment, the operations comprising:
installing the plugins at a plugin server remote from a management server for the virtualized computing environment, for execution remotely from the management server,
wherein elements of a core user interface from the management server are loaded, via a first port of a reverse proxy of the management server, into a user interface of a web client;
loading, via a second port of the reverse proxy of the management server and into the user interface of the web client, elements of a first plugin from the plugin server;
isolating at least some of the loaded elements of the first plugin from the core user interface;
loading, via the second port of the reverse proxy of the management server and into the user interface of the web client, elements of a second plugin from the plugin server; and
isolating the loaded elements of the first plugin from the loaded elements of the second plugin, wherein isolating the loaded elements of the first plugin from the loaded elements of the second plugin includes:
loading the elements of the first plugin into a first iframe; and
loading the elements of the second plugin into a second iframe, and
wherein the web client executes the first and second plugins remotely from the management server.
8. The non-transitory computer-readable medium of claim 7 , wherein:
the first iframe is associated with a first shadow document object model (shadow DOM); and
the second iframe is associated with a second shadow document object model (shadow DOM) different from the first shadow DOM.
9. The non-transitory computer-readable medium of claim 8 , wherein the first iframe, the first shadow DOM, the second iframe, and the second shadow DOM are associated with a common plugin sandbox at the web client.
10. The non-transitory computer-readable medium of claim 7 , wherein the operations further comprise:
registering the plugins installed at the plugin server with an extension manager of the management server.
11. The non-transitory computer-readable medium of claim 7 , wherein forwarding/redirection rules to the plugin server are registered with the reverse proxy.
12. The non-transitory computer-readable medium of claim 7 , wherein the elements of the first plugin include user interface elements that extend functionality of the core user interface.
13. A system, comprising:
a management server for a virtualized computing environment, wherein the management server includes a reverse proxy, and wherein the management server is configured to load, via a first port of the reverse proxy and into a user interface of a web client, elements of a core user interface from the management server; and
a plugin server configured to remotely communicate with the management server via the reverse proxy of the management server,
wherein the plugin server includes plugins installed therein for execution remotely from the management server,
wherein the plugin server is further configured to:
load, via a second port of the reverse proxy and into the user interface of the web client, elements of a first plugin from the plugin server,
wherein at least some of the loaded elements of the first plugin are isolated from the core user interface;
load, via the second port of the reverse proxy and into the user interface of the web client, elements of a second plugin from the plugin server; and
isolate the loaded elements of the first plugin from the loaded elements of the second plugin,
wherein to isolate the loaded elements of the first plugin from the loaded elements of the second plugin, the plugin server is configured to:
load the elements of the first plugin into a first iframe; and
load the elements of the second plugin into a second iframe, and
wherein the web client executes the first and second plugins remotely from the management server.
14. The system of claim 13 , wherein:
the first iframe is associated with a first shadow document object model (shadow DOM); and
the second iframe is associated with a second shadow document object model (shadow DOM) different from the first shadow DOM.
15. The system of claim 14 , wherein the first iframe, the first shadow DOM, the second iframe, and the second shadow DOM are associated with a common plugin sandbox at the web client.
16. The system of claim 13 , wherein the management server includes an extension manager configured to maintain a registration of the plugins installed at the plugin server.
17. The system of claim 13 , wherein the reverse proxy is registered with forwarding/redirection rules to the plugin server.
18. The system of claim 13 , wherein the elements of the first plugin include user interface elements that extend functionality of the core user interface.