telefonicaiot/orchestrator repository overview

⁠Orchestrator

Orchestrator tries to group all provision operations for IoT platform that typically implies several steps or several systems' interaction. Orchestrator exposes an API and provides scripts to perform all these operations. Scripts simplifies the inherent usage of keystone, such as usage of long identifiers not so easy to remember and to use, using names and resolving internally to deal with keystone. Orchestrator scripts can interact with any remote 3rd party, since related host and port should be provideed as argument to earch script.

A typical scenario for IoT Platform can be these scenarios⁠.

---

⁠Purpose

Orchestrator is used to:

• Create/List/Update/Delete services
• Create/List/Update/Delete subservices
• Create/List/Update/Delete users in a service
• Create/List/Update/Delete roles in a service
• Create/List/Update/Delete groups in a service
• Assign/unassign roles to users in a service
• Create/List Trust Tokens
• Activate / deactivate IoT Modules
• Retrieve statistics and metrics about API usage
• Retrieve stats about UWSGI server usage
• Create, List, Modify LDAP Users
• Create, List, Modify LDAP Groups

---

⁠Ingredients

Orchestrator is based mainly on:

• Python 3 needed
• Django / DjangoRestFramework
• UWSGI

---

⁠Dependencies

Orchestrator relies on these other IoT parts:

• Identity Manager: Keystone (mandatory)
• Access Control: Keypass (mandatory)
• Context Broker: Orion (optional)
• CEP: Perseo (optional)
• Cygnus (optional)
• OpenLDAP (optional)
• Mailer (optional)
• MongoDB (optional)

Some of these IoT parts are optional, this means that orchestrator can work without them but excluding the part of feature in which are involved. This way Keystone and Keypass are mandatory to deal with Orchestrator.

These are all dependencies requirements.txt⁠.

Orchestrator needs a WSGI server like Apache, Lighttpd or NGIX: wsgi.py⁠.

Orchestrator interacts mainly with Identity Manager Keystone⁠ and Access Control Keypass⁠. Since ContextBroker and CEP are secured elements (by PepProxy⁠) orchestrator can interact directly with tem using user provided credencials. If credencials or access control level is not enoght then orchestrator operation will not be performed.

---

⁠Documentation

In this README document you could find how to get started with the application and basic concepts. For a more detailed information you can read the following docs:

• API⁠
• Scripts⁠
• Logs and Alarms⁠
• Installation guide⁠
• Configuration⁠
• IoTModules⁠
• Docker configuraton⁠
• Tests⁠

---

⁠License

Orchestrator is licensed under Affero General Public License (GPL) version 3⁠.

© 2026 Telefonica Investigación y Desarrollo, S.A.U

Further information on the use of the AGPL open source license

⁠Are there any legal issues with AGPL 3.0? Is it safe for me to use?

There is absolutely no problem in using a product licensed under AGPL 3.0. Issues with GPL (or AGPL) licenses are mostly related with the fact that different people assign different interpretations on the meaning of the term “derivate work” used in these licenses. Due to this, some people believe that there is a risk in just using software under GPL or AGPL licenses (even without modifying it).

For the avoidance of doubt, the owners of this software licensed under an AGPL-3.0 license wish to make a clarifying public statement as follows:

Please note that software derived as a result of modifying the source code of this software in order to fix a bug or incorporate enhancements is considered a derivative work of the product. Software that merely uses or aggregates (i.e. links to) an otherwise unmodified version of existing software is not considered a derivative work, and therefore it does not need to be released as under the same license, or even released as open source.