.. _tutor_configuration: Tutor plugin: configuration =========================== .. contents:: On this page :local: :depth: 2 All plugin settings are Tutor variables prefixed with ``PANORAMA_``. Set them with ``tutor config save --set PANORAMA_...=value``. This page lists the variables and the AWS permissions needed for CUSTOM mode. .. important:: The plugin follows Open edX's named releases, and its default values can change between release lines. The defaults below are for the **Sumac (19.x)** line; where a value differs on the **Teak (21.x+)** line it is annotated. Some variables also exist on only one line. Always confirm the effective value for **your** installed version with: .. code-block:: shell tutor config printvalue PANORAMA_MODE tutor plugins list # shows the installed panorama plugin version Use the plugin version that matches your Open edX release. Configuration variables ----------------------- .. list-table:: :header-rows: 1 :widths: 34 22 44 * - Variable - Default - Description * - ``PANORAMA_MODE`` - ``DEMO`` - Panorama mode: ``DEMO``, ``FREE``, ``SAAS``, or ``CUSTOM``. See :ref:`tutor_installation`. * - ``PANORAMA_BUCKET`` - (empty) - S3 bucket that stores the raw extracted data. Required in CUSTOM mode. * - ``PANORAMA_RAW_LOGS_BUCKET`` - ``PANORAMA_BUCKET`` - S3 bucket for the tracking logs. * - ``PANORAMA_BASE_PREFIX`` - ``openedx`` - Subdirectory inside the bucket that holds the raw data. * - ``PANORAMA_AWS_ACCOUNT_ID`` - (empty) - AWS account ID that owns the data lake and QuickSight. * - ``PANORAMA_REGION`` - ``us-east-1`` - AWS region. * - ``PANORAMA_DATALAKE_DATABASE`` - ``panorama`` - Athena database name. * - ``PANORAMA_DATALAKE_WORKGROUP`` - ``panorama`` - Athena workgroup name. * - ``PANORAMA_AWS_ACCESS_KEY`` - ``OPENEDX_AWS_ACCESS_KEY`` - AWS access key (defaults to the Open edX AWS key). * - ``PANORAMA_AWS_SECRET_ACCESS_KEY`` - ``OPENEDX_AWS_SECRET_ACCESS_KEY`` - AWS secret key (defaults to the Open edX AWS secret). * - ``PANORAMA_MFE_ENABLED`` - ``True`` - Enable the Panorama MFE. Also gates installing the backend into the ``openedx`` image. * - ``PANORAMA_ADD_DASHBOARD_LINK`` - ``False`` - **Sumac (19.x) line only.** Replace the learner-dashboard MFE with a fork that adds a link to Panorama. Removed on Teak (21.x+), where the plugin registers the Panorama MFE directly and no longer swaps the learner dashboard. * - ``PANORAMA_DEFAULT_USER_ARN`` - ``arn:aws:quicksight:{REGION}:{ACCOUNT_ID}:user/default/{LMS_HOST}`` - QuickSight user ARN to map users to by default. * - ``PANORAMA_ENABLE_STUDENT_VIEW`` - ``True`` - Allow students to access the student panel. * - ``PANORAMA_MFE_PORT`` - ``2100`` - Internal port of the Panorama MFE. * - ``PANORAMA_CRONTAB`` - ``55 * * * *`` - Cron schedule for the periodic dataset update. * - ``PANORAMA_USE_SPLIT_MONGO`` - ``True`` - Set to ``False`` for Open edX versions older than Maple. * - ``PANORAMA_FLB_LOG_LEVEL`` - ``info`` - Fluent Bit logging level (tracking-log shipping). * - ``PANORAMA_RUN_K8S_FLUENTBIT`` - ``True`` - On Kubernetes, run the Fluent Bit DaemonSet. Leave only **one** namespace running it. * - ``PANORAMA_DEBUG`` - ``False`` - Run the ELT agent in verbose debug mode. * - ``PANORAMA_LOGS_TOTAL_FILE_SIZE`` - ``1M`` (Sumac 19.x); ``50M`` (Teak 21.x+) - Log file size threshold before upload. * - ``PANORAMA_LOGS_UPLOAD_TIMEOUT`` - ``15m`` (Sumac 19.x); ``10m`` (Teak 21.x+) - Maximum time before log files are uploaded even if under the size limit. * - ``PANORAMA_LOGS_UPLOAD_CHUNK_SIZE`` - ``10M`` (Teak 21.x+ only) - Multipart upload chunk size for tracking logs. Not present on the Sumac (19.x) line. * - ``PANORAMA_K8S_JOB_MEMORY_REQUEST`` / ``PANORAMA_K8S_JOB_MEMORY_LIMIT`` - (empty) - Memory request/limit for the Panorama job on Kubernetes. Use only if pods are OOM-killed. .. note:: By default ``PANORAMA_AWS_ACCESS_KEY`` and ``PANORAMA_AWS_SECRET_ACCESS_KEY`` inherit the Open edX AWS credentials. In CUSTOM mode, point them at the dedicated Panorama IAM user instead of reusing broad credentials. .. _tutor_custom_datalake: CUSTOM mode: the AWS data lake ------------------------------ The plugin is configured to work with an AWS data lake. In CUSTOM mode you provide it. Create: * an **IAM user or role** with access to the S3 buckets, KMS (if encrypted), Glue, and Athena; * an S3 bucket for the **data** (``PANORAMA_BUCKET``), optionally one for **raw logs** (``PANORAMA_RAW_LOGS_BUCKET``), and one for the **Athena query results**; * the Athena database (``CREATE DATABASE panorama``) and a ``panorama`` workgroup whose query result location is the results bucket. Then connect Amazon QuickSight to Athena to visualize the data. See :ref:`elt_datalake` for the underlying resource details. IAM permissions ~~~~~~~~~~~~~~~ The plugin's README ships a scoped policy for the ``panorama-elt`` user. Replace the bucket, region, and account placeholders with your values. It grants: * ``s3:PutObject`` on ``/openedx/*`` and ``/tracking_logs/*`` (the extraction and tracking-log upload paths); * ``s3:PutObject`` and ``s3:DeleteObject`` on ``/PanoramaConnectionTest`` (the connection test object); * ``s3:GetBucketLocation``, ``s3:PutObject``, and ``s3:GetObject`` on the ```` (and its contents); * the Glue and Athena actions needed to create and update tables, partitions, and run queries, scoped to the ``panorama`` workgroup, database, catalog, and tables; and * ``kms:GenerateDataKey`` and ``kms:Decrypt`` if the buckets are KMS-encrypted. .. important:: Additionally, the user must have **AWS Lake Formation** permissions to access the data locations and to query the database and all tables. Without them, Glue/Athena calls can succeed at the IAM layer but still be denied by Lake Formation. For the exact JSON, see the plugin's ``README.rst``. Note that this scoped policy is preferable to the broad ``s3:*`` form; see the least-privilege guidance in :ref:`elt_datalake`. `Back to Home `_