Read only mode

docs/config.rst

@@ -540,3 +540,19 @@ Default: None
 Sets the URI to which an OAuth 2.0 server redirects the user after successful authentication and authorization.
 
 `oauth2_redirect_uri` option should be used with :ref:`auth`, :ref:`auth_provider`, :ref:`oauth2_key` and :ref:`oauth2_secret` options.
+
+.. _read_only:
+
+read_only
+~~~~~~~~~
+
+Default: False
+
+Enables read only mode, disabling all control operations in the UI and API.
+
+When read only mode is enabled, Flower will not allow any control operations to be performed on the system.
+
+Example::
+
+    $ celery flower --read_only
+

flower/api/control.py

@@ -51,8 +51,12 @@ def post(self, workername):
 :reqheader Authorization: optional OAuth token to authenticate
 :statuscode 200: no error
 :statuscode 401: unauthorized request
+:statuscode 403: read only mode is enabled
 :statuscode 404: unknown worker
         """
+        if self.application.options.read_only:
+            raise web.HTTPError(403, "Read only mode is enabled")
+
         if not self.is_worker(workername):
             raise web.HTTPError(404, f"Unknown worker '{workername}'")
 
@@ -90,9 +94,12 @@ def post(self, workername):
 :reqheader Authorization: optional OAuth token to authenticate
 :statuscode 200: no error
 :statuscode 401: unauthorized request
-:statuscode 403: pool restart is not enabled (see CELERYD_POOL_RESTARTS)
+:statuscode 403: pool restart is not enabled (see CELERYD_POOL_RESTARTS) or read only mode is enabled
 :statuscode 404: unknown worker
         """
+        if self.application.options.read_only:
+            raise web.HTTPError(403, "Read only mode is enabled")
+
         if not self.is_worker(workername):
             raise web.HTTPError(404, f"Unknown worker '{workername}'")
 
@@ -139,10 +146,13 @@ def post(self, workername):
 :reqheader Authorization: optional OAuth token to authenticate
 :statuscode 200: no error
 :statuscode 401: unauthorized request
-:statuscode 403: failed to grow
+:statuscode 403: failed to grow or read only mode is enabled
 :statuscode 404: unknown worker
         """
 
+        if self.application.options.read_only:
+            raise web.HTTPError(403, "Read only mode is enabled")
+
         if not self.is_worker(workername):
             raise web.HTTPError(404, f"Unknown worker '{workername}'")
 
@@ -190,9 +200,12 @@ def post(self, workername):
 :reqheader Authorization: optional OAuth token to authenticate
 :statuscode 200: no error
 :statuscode 401: unauthorized request
-:statuscode 403: failed to shrink
+:statuscode 403: failed to shrink or read only mode is enabled
 :statuscode 404: unknown worker
         """
+
+        if self.application.options.read_only:
+            raise web.HTTPError(403, "Read only mode is enabled")
 
         if not self.is_worker(workername):
             raise web.HTTPError(404, f"Unknown worker '{workername}'")
@@ -243,9 +256,11 @@ def post(self, workername):
 :reqheader Authorization: optional OAuth token to authenticate
 :statuscode 200: no error
 :statuscode 401: unauthorized request
-:statuscode 403: autoscaling is not enabled (see CELERYD_AUTOSCALER)
+:statuscode 403: autoscaling is not enabled (see CELERYD_AUTOSCALER) or read only mode is enabled
 :statuscode 404: unknown worker
         """
+        if self.application.options.read_only:
+            raise web.HTTPError(403, "Read only mode is enabled")
 
         if not self.is_worker(workername):
             raise web.HTTPError(404, f"Unknown worker '{workername}'")
@@ -299,9 +314,12 @@ def post(self, workername):
 :reqheader Authorization: optional OAuth token to authenticate
 :statuscode 200: no error
 :statuscode 401: unauthorized request
-:statuscode 403: failed to add consumer
+:statuscode 403: failed to add consumer or read only mode is enabled
 :statuscode 404: unknown worker
         """
+        if self.application.options.read_only:
+            raise web.HTTPError(403, "Read only mode is enabled")
+
         if not self.is_worker(workername):
             raise web.HTTPError(404, f"Unknown worker '{workername}'")
 
@@ -352,9 +370,12 @@ def post(self, workername):
 :reqheader Authorization: optional OAuth token to authenticate
 :statuscode 200: no error
 :statuscode 401: unauthorized request
-:statuscode 403: failed to cancel consumer
+:statuscode 403: failed to cancel consumer or read only mode is enabled
 :statuscode 404: unknown worker
         """
+        if self.application.options.read_only:
+            raise web.HTTPError(403, "Read only mode is enabled")
+
         if not self.is_worker(workername):
             raise web.HTTPError(404, f"Unknown worker '{workername}'")
 
@@ -406,7 +427,11 @@ def post(self, taskid):
 :reqheader Authorization: optional OAuth token to authenticate
 :statuscode 200: no error
 :statuscode 401: unauthorized request
+:statuscode 403: read only mode is enabled
         """
+        if self.application.options.read_only:
+            raise web.HTTPError(403, "Read only mode is enabled")
+
         logger.info("Revoking task '%s'", taskid)
         terminate = self.get_argument('terminate', default=False, type=bool)
         signal = self.get_argument('signal', default='SIGTERM', type=str)
@@ -447,8 +472,12 @@ def post(self, taskname):
 :reqheader Authorization: optional OAuth token to authenticate
 :statuscode 200: no error
 :statuscode 401: unauthorized request
+:statuscode 403: read only mode is enabled
 :statuscode 404: unknown task/worker
         """
+        if self.application.options.read_only:
+            raise web.HTTPError(403, "Read only mode is enabled")
+
         workername = self.get_argument('workername')
         hard = self.get_argument('hard', default=None, type=float)
         soft = self.get_argument('soft', default=None, type=float)
@@ -507,8 +536,12 @@ def post(self, taskname):
 :reqheader Authorization: optional OAuth token to authenticate
 :statuscode 200: no error
 :statuscode 401: unauthorized request
+:statuscode 403: read only mode is enabled
 :statuscode 404: unknown task/worker
         """
+        if self.application.options.read_only:
+            raise web.HTTPError(403, "Read only mode is enabled")
+
         workername = self.get_argument('workername')
         ratelimit = self.get_argument('ratelimit')
 

flower/api/tasks.py

@@ -117,8 +117,12 @@ async def post(self, taskname):
 :reqheader Authorization: optional OAuth token to authenticate
 :statuscode 200: no error
 :statuscode 401: unauthorized request
+:statuscode 403: read only mode is enabled
 :statuscode 404: unknown task
         """
+        if self.application.options.read_only:
+            raise web.HTTPError(403, "Read only mode is enabled")
+
         args, kwargs, options = self.get_task_args()
         logger.debug("Invoking a task '%s' with '%s' and '%s'",
                      taskname, args, kwargs)
@@ -192,8 +196,12 @@ def post(self, taskname):
 :reqheader Authorization: optional OAuth token to authenticate
 :statuscode 200: no error
 :statuscode 401: unauthorized request
+:statuscode 403: read only mode is enabled
 :statuscode 404: unknown task
         """
+        if self.application.options.read_only:
+            raise web.HTTPError(403, "Read only mode is enabled")
+
         args, kwargs, options = self.get_task_args()
         logger.debug("Invoking a task '%s' with '%s' and '%s'",
                      taskname, args, kwargs)
@@ -254,8 +262,12 @@ def post(self, taskname):
 :reqheader Authorization: optional OAuth token to authenticate
 :statuscode 200: no error
 :statuscode 401: unauthorized request
+:statuscode 403: read only mode is enabled
 :statuscode 404: unknown task
         """
+        if self.application.options.read_only:
+            raise web.HTTPError(403, "Read only mode is enabled")
+
         args, kwargs, options = self.get_task_args()
         logger.debug("Invoking task '%s' with '%s' and '%s'",
                      taskname, args, kwargs)
@@ -298,6 +310,7 @@ def get(self, taskid):
 :reqheader Authorization: optional OAuth token to authenticate
 :statuscode 200: no error
 :statuscode 401: unauthorized request
+:statuscode 403: read only mode is enabled
 :statuscode 503: result backend is not configured
         """
         timeout = self.get_argument('timeout', None)
@@ -344,8 +357,12 @@ def post(self, taskid):
 :reqheader Authorization: optional OAuth token to authenticate
 :statuscode 200: no error
 :statuscode 401: unauthorized request
+:statuscode 403: read only mode is enabled
 :statuscode 503: result backend is not configured
         """
+        if self.application.options.read_only:
+            raise web.HTTPError(403, "Read only mode is enabled")
+
         logger.info("Aborting task '%s'", taskid)
 
         result = AbortableAsyncResult(taskid)

flower/options.py

@@ -68,6 +68,7 @@
 define("url_prefix", type=str, help="base url prefix")
 define("task_runtime_metric_buckets", type=float, default=Histogram.DEFAULT_BUCKETS,
        multiple=True, help="histogram latency bucket value")
-
+define("read_only", type=bool, default=False,
+       help="enable read only mode, disabling all operations")
 
 default_options = options

flower/templates/worker.html

@@ -16,6 +16,7 @@
         <h3 id="workername">{{ worker['name'] }}</h3>
       </div>
 
+      {% if not read_only %}
       <div class="btn-group float-end" role="group" aria-label="Button Group">
         <button id="worker-group" type="button" class="btn btn-primary dropdown-toggle" data-bs-toggle="dropdown"
           aria-expanded="false">
@@ -28,6 +29,7 @@ <h3 id="workername">{{ worker['name'] }}</h3>
           <li><a id="worker-refresh-all" class="dropdown-item" data-bs-dismiss="dropdown">Refresh All</a></li>
         </ul>
       </div>
+      {% end %}
 
       <div class="tabbable">
         <ul class="nav nav-tabs" role="tablist">
@@ -84,6 +86,7 @@ <h3 id="workername">{{ worker['name'] }}</h3>
                   </table>
                 </div>
 
+                {% if not read_only %}
                 <div class="col-lg-4 container">
                   <form class="mx-auto">
                     <legend class="form-label mt-md-5">Pool size control</legend>
@@ -103,6 +106,7 @@ <h3 id="workername">{{ worker['name'] }}</h3>
                     </div>
                   </form>
                 </div>
+                {% end %}
               </div>
 
               {% if worker['stats'].get('autoscaler', None) %}
@@ -154,7 +158,9 @@ <h3 id="workername">{{ worker['name'] }}</h3>
                   <th>Queue arguments</th>
                   <th>Binding arguments</th>
                   <th>Auto delete</th>
+                  {% if not read_only %}
                   <th style="width: 125px;"></th>
+                  {% end %}
                 </tr>
               </thead>
               <tbody id="worker-queues">
@@ -170,19 +176,23 @@ <h3 id="workername">{{ worker['name'] }}</h3>
                   <td>{{ queue['queue_arguments'] }}</td>
                   <td>{{ queue['binding_arguments'] }}</td>
                   <td>{{ queue['auto_delete'] }}</td>
-                  <td><button id="worker-cancel-consumer-{{ queue['name'] }}" class="btn btn-danger text-nowrap">Cancel
-                      Consumer</button></td>
+                  {% if not read_only %}
+                    <td><button id="worker-cancel-consumer-{{ queue['name'] }}" class="btn btn-danger text-nowrap">Cancel
+                        Consumer</button></td>
+                  {% end %}
                 </tr>
                 {% end %}
               </tbody>
             </table>
+            {% if not read_only %}
             <div class="control-group col-lg-3">
               <div class="input-group mb-3">
                 <input id="add-consumer-name" type="text" class="form-control" placeholder="New consumer"
                   aria-label="New consumer" aria-describedby="worker-add-consumer">
                 <button class="btn btn-primary mx-1" type="button" id="worker-add-consumer">Add</button>
               </div>
             </div>
+            {% end %}
           </div> <!-- end queues tab -->
 
           <div class="tab-pane fade" id="tab-tasks" role="tabpanel" aria-labelledby="tab-tasks">
@@ -304,19 +314,23 @@ <h3 id="workername">{{ worker['name'] }}</h3>
                       <div class="form-group">
                         <div class="input-group">
                           <input class="form-control form-control-sm" type="number">
+                          {% if not read_only %}
                           <button class="btn btn-primary btn-sm mx-1" type="button"
                             id="task-rate-limit-{{taskname}}">Apply</button>
+                          {% end %}
                         </div>
                       </div>
                     </td>
                     <td class="col-lg-2">
                       <div class="form-group">
                         <div class="input-group">
                           <input class="form-control form-control-sm" type="number">
+                          {% if not read_only %}
                           <button class="btn btn-primary btn-sm mx-1" type="button"
                             id="task-timeout-soft-{{taskname}}">Soft</button>
                           <button class="btn btn-primary btn-sm mx-1" type="button"
                             id="task-timeout-hard-{{taskname}}">Hard</button>
+                          {% end %}
                         </div>
                       </div>
                     </td>
@@ -387,4 +401,5 @@ <h3 id="workername">{{ worker['name'] }}</h3>
       </div>
     </div>
   </div>
-  {% end %}
+</div>
+{% end %}

flower/views/workers.py

@@ -24,7 +24,11 @@ async def get(self, name):
         if 'stats' not in worker:
             raise web.HTTPError(404, f"Unable to get stats for '{name}' worker")
 
-        self.render("worker.html", worker=dict(worker, name=name))
+        self.render(
+            "worker.html",
+            worker=dict(worker, name=name),
+            read_only=self.application.options.read_only,
+        )
 
 
 class WorkersView(BaseHandler):