Launchpad

Overview

Launchpad is an application gateway for the Apolo MLOps platform that enables Apolo users to securely expose platform applications to end-users through customizable authentication powered by Keycloak integration.

With Launchpad, you can share access to applications deployed on Apolo—including pre-built apps like OpenWebUI (a user-friendly interface for interacting with LLMs)—without requiring end-users to have full Apolo accounts. Additionally, Launchpad allows you to deploy custom applications using Apolo's Service Deployment feature and expose them to your users with personalized branding, including custom names, descriptions, and logos.

Key capabilities include:

• Bring Your Own Authentication: Deploy and manage a dedicated Keycloak instance for user authentication, with support for user management, role-based access control, groups, and integration with external identity providers (OIDC, OAuth2)

• Flexible App Deployment Models:

  • Shared Applications: Deploy a single app instance accessible to all users, with the application leveraging user identity information provided by Keycloak (ideal for apps like OpenWebUI that support multi-user collaboration)

  • Per-User Applications: Automatically provision isolated app instances for each user, ensuring complete data separation and personalized environments

• Custom Branding: Import custom applications or existing app instances with tailored metadata—display names, descriptions, and visual identities—to create a polished experience for your end-users

• Flexible App Exposure: Share both platform-native Apolo applications and custom-deployed services through a unified, user-friendly interface

• Quickstart Presets: Deploy pre-configured application stacks like OpenWebUI with all dependencies in minutes

• External User Access: Provide seamless application access to clients, stakeholders, or team members outside your Apolo organization through Keycloak-managed authentication

---

Installing Launchpad

Launchpad can be installed from the Apolo Console interface or using the Apolo CLI.

Installation via Apolo Console

1. Navigate to the Apps page in the Apolo Console.

2. Find the Launchpad App and click Install.

3. Configure Launchpad Preset:

   • Choose a suitable Resource Preset for the Launchpad application itself (e.g., cpu-medium or higher).

4. Choose Quickstart Apps:

   • No Startup Apps: Installs only Launchpad, allowing you to add applications later.

   • OpenWebUI: Installs OpenWebUI and its dependencies upon Launchpad startup, providing a pre-configured LLM chat interface.

OpenWebUI Configuration (Optional)

If you select the OpenWebUI, you need to configure the following dependencies:

• LLM Configuration:

  • Pre-configured HuggingFace LLM Model: Select the desired LLM model (e.g., meta-llama/Llama-3.1-8B-Instruct).

  • Hugging Face Token (Optional): If using gated or private models, provide a Hugging Face API token stored as an Apolo Secret (HF_TOKEN).

  • LLM Preset: Choose a resource preset for the LLM model (typically a GPU-enabled preset, e.g., gpu-a100-x1).

• Postgres Configuration:

  • Postgres Preset: Choose a resource preset for the Postgres database (e.g., cpu-medium).

  • Postgres Replicas: Set the number of replicas (e.g., 1).

• Text Embeddings Configuration:

  • Text Embeddings Preset: Choose a resource preset for the embeddings service (e.g., gpu-l4-x1).

  • Embeddings Model: Select a pre-configured Hugging Face model for text embeddings (e.g., BAAI/bge-m3).

1. Metadata (Optional): You can customize the app display name.

2. Click Install.

Be aware that when choosing the OpenWebUI Quick Start App option, Apolo will also install vLLM, Text Embeddings and Postgresql apps, which will consume credits as well.

Installation via Apolo CLI

Currently, due to a known bug in the UI, if you choose the OpenWebUI Quick Start App, it's recommended to export the configuration and install it using the Apolo CLI:

1. In the Launchpad App installation page, select the OpenWebUI Quick Start App and configure your options.

2. Scroll to the bottom and click Export App Configuration (download icon).

3. Open your terminal and install the app using the downloaded configuration file:

apolo app install --file launchpad-custom-app-installation-config.yaml

Refer to Launchpad CLI page to learn more about installing and managing Launchpad using the CLI.

---

Managing Launchpad and Keycloak Users

Once Launchpad is installed, you can access the installed app on the Installed Apps page. Click Open to access various Launchpad URLs.

Accessing the Launchpad Interface

1. Click Open on the Launchpad app card.

2. Select App URL.

3. The Launchpad interface loads, requiring a login.\

   
4. Launchpad comes with a default admin user that can manage what apps are available through Launchpad UI. You can find this admin user's credentials by scrolling down the Launchpad instance details page in Apolo and copying the Password field in Launchpad Default Admin User\

   
5. Use these credentials to login to Launchpad. You should see a list of available apps - only OpenWebUI for now

   

Managing Users via Keycloak

Launchpad uses Keycloak for authentication and user management.

1. Access Keycloak:

   • On the Launchpad app card (in Apolo), click Open.

   • Select Keycloak Config > Web App URL.

2. Retrieve Admin Credentials:

   • Go to the Launchpad Details page in the Apolo Console.

   • Under the Output section, find Launchpad Default Admin User to retrieve the default username (admin) and Password.

   • Scroll down to KeycloakConfig to find the Keycloak Admin Password (used for the Keycloak administrative interface).

3. Log into Keycloak:

   • Use the Keycloak Admin Password and the username admin to sign in to the Keycloak Administration page.

   • Click Manage Realms Click Launchpad. This will ensure that any settings you change are applied to the correct realm used by Launchpad.

4. Manage Users and Groups:

   • Add User: Navigate to Users and click Add user to create new users.

   • Manage Roles and Groups: Navigate to Groups to create groups and assign roles/permissions to users.

5. Enable New Sign-Ups (for OpenWebUI):

   • If you deployed OpenWebUI, ensure users can sign up:

     • Navigate to OpenWebUI in the Installed Apps list.

     • Open the Admin Panel (available to the admin user).

     • Go to Settings > Authentication.

     • Toggle Enable New Sign Ups to On.

     • Save settings.

Adding an External Identity Provider (OIDC/Social Login)

Launchpad allows you to integrate external Identity Providers (IdP), such as Google or Microsoft, so users can sign in using their existing accounts instead of manually created Keycloak credentials.

Access the Launchpad Realm in Keycloak

1. Log into the Keycloak Administration console.

2. In the top-left dropdown (or via the Manage Realms menu), ensure you have selected the Launchpad realm.

   • Note: Do not perform these configurations in the "Master" realm.

Add the Provider

1. Navigate to Identity Providers in the left-hand sidebar.

2. Select your desired provider from the list (e.g., Google).

3. Enter Credentials: You will need the Client ID and Client Secret obtained from your provider's developer console (e.g., Google Cloud Console).

4. Configuration Settings:

   • Request refresh token: Toggle this to On to ensure users stay logged in.

   • Trust Email: Under the Advanced settings at the bottom, it is recommended to toggle Trust Email to On if you want Keycloak to verify users based on their provider email.

5. Click Add.

Configure Redirect URIs

To avoid a redirect_uri_mismatch error, you must whitelist the Keycloak callback URL in your Identity Provider's settings.

1. In the Keycloak Identity Provider settings for the provider you just added, find and copy the Redirect URI. It usually looks like this: https://<launchpad-url>/auth/realms/launchpad/broker/google/endpoint

2. Go to your Provider’s Developer Console (e.g., Google Cloud Console -> APIs & Services -> Credentials).

3. Under Authorized redirect URIs, paste the URI you copied from Keycloak.

4. (Optional) Under Authorized JavaScript origins, add the base URL of your Launchpad Keycloak instance: https://<launchpad-url>

5. Save the changes in the provider’s console.

Verify the Integration

1. Open your Launchpad App URL.

2. Click Log In.

3. You should now see an option to Sign in with [Provider Name] (e.g., Google) below the standard login fields.

4. Click the button and complete the OAuth flow to verify that you are successfully redirected back to the Launchpad interface.

---

Integration Tip:

If you are using OpenWebUI with an external IdP, ensure that Enable New Sign Ups is toggled to On in the OpenWebUI Admin Panel (Settings > Authentication) so that users logging in via the IdP for the first time can have their accounts automatically created.

---

Accessing App Endpoints via API (Bearer Token)

Launchpad allows you to interact with your deployed applications programmatically. By leveraging the integrated Keycloak instance, you can generate a Bearer Token to securely access your application's API endpoints (such as a vLLM inference server) without using the browser interface.

Enable Direct Access Grants in Keycloak

To fetch tokens using user credentials via the API, you must first enable the correct capability in the Keycloak configuration:

1. Log into the Keycloak Administration console.

2. Ensure you have selected the Launchpad realm.

3. Navigate to Clients in the left-hand sidebar and select the frontend client.

4. Scroll down to the Capability config section.

5. Ensure the Direct access grants toggle is set to On.

6. Click Save.

Obtaining an Access Token

You can obtain an access token by sending a POST request to the Launchpad authentication endpoint.

Use the Admin API URL: When performing API authentication, you must use the Admin API URL provided in the Apolo Console, not the standard App URL. You can distinguish the API URL by the -api suffix in the subdomain (e.g., https://launchpad-xxx-api.apps...).

Example using curl and jq:

# Set your Launchpad Admin API URL (the one with the -api suffix)
export LAUNCHPAD_API_URL="https://launchpad-<id>-api.apps.dev.apolo.us"
export LAUNCHPAD_USER="admin"
export LAUNCHPAD_PASSWORD="<your-admin-password>"

# Fetch the token from the /auth/token endpoint
TOKEN_RESPONSE=$(curl -s -X POST "$LAUNCHPAD_API_URL/auth/token" \
  -H "Content-Type: application/json" \
  -d "{
    \"username\": \"$LAUNCHPAD_USER\",
    \"password\": \"$LAUNCHPAD_PASSWORD\",
    \"scope\": \"openid profile email offline_access\"
  }")

# Extract the access token
ACCESS_TOKEN=$(echo $TOKEN_RESPONSE | jq -r '.access_token')

echo "Access Token: $ACCESS_TOKEN"

Authenticating API Requests

Once you have the ACCESS_TOKEN, you can include it in the Authorization header of your requests to any application managed by Launchpad. Use the specific App URL of the service you are trying to reach (e.g., your vLLM or custom service).

Example: Accessing vLLM Models Endpoint

Follow the instructions in Importing Apps using the Admin Panelto import a running vLLM instance to run this example.

curl -X GET "https://<your-vllm-app-url>/v1/models" \
  -H "accept: application/json" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

If you attempt to access these endpoints without the Authorization header or with an invalid token, Launchpad will deny the request, ensuring your services remain secure.

---

Importing Apps

Importing Apps using the Admin Panel

Launchpad comes with a Admin Panel that allows you to manage app templates and running app instances directly through the Launchpad Admin Panel.

Video Demo

To Access the Admin Panel: Log into Launchpad using the default admin credentials (available in app outputs) and click Admin Panel (top right).

This is what the Admin Panel looks like when there are no templates or instances imported.

Import a New Template:

• Obtain an App Template by following this guide.

• Click Import Template.

  
• Click Upload File and select the .yaml configuration file you prepared in the previous step.

• The fields will automatically populate with information from the Apolo Apps API. You can manually edit the:

  • Display Name

  • Logo URL (as demonstrated in the video)

  • Short/Long Description

  • Tags

  • Input (JSON): Modify default configuration values.

• Check or uncheck Shared based on whether you want a single instance for all users (Shared) or a new instance provisioned for each user (Not Shared).

• Click Import Template. The new template will appear under App Templates.

  
• After importing, the app will be visible in the main Launchpad interface, ready for users to click Open and launch their instance.

  

• After installing the app by clicking "Open", the new app instance will also appear in the list of App Instances on the Admin Page

  

Using the App Templates list, you can:

• View: Displays all metadata and configuration associated with the template.

• Edit: Allows modification of the display name, logo, descriptions, tags, and sharing settings.

• Delete: Removes the template. Warning: Deleting a template will uninstall all associated running instances.

Importing a Running App Instance

You can also import apps that are already running in Apolo into Launchpad.

• Install a Service Deployment app by following this guide.

• Click Import App Instance.

• The panel will load all running apps in your current Apolo project.

  
• Select the desired running app instance (e.g., a Service Deployment).

• Configure the display details (Name, Logo URL, Description).

  • You can customize the app's name, description, logo and etc. For the purposes of this tutorial, we will rename this app to My Custom App

• Click Import App. The running app instance will now be visible in the main Launchpad interface under its new name and accessible to authenticated Keycloak users.

  

Using the App Instances list you can:

• Open: Directly navigates to the running application URL.

• Delete: Uninstalls the specific app instance from Apolo.

Importing Apps using Admin API

Refer to Launchpad CLI page to learn more about installing and managing Launchpad using the CLI.

---

Summary

The Launchpad app transforms the Apolo MLOps platform into a user-friendly deployment environment, simplifying application access and user authentication for internal and external users via Keycloak integration. By enabling the import of custom app templates and existing app instances, Launchpad offers a versatile solution for showcasing and managing applications within your ecosystem.

Quick Guides

Obtaining and Preparing App Templates for Launchpad

Before importing a custom application template into Launchpad using the API, you must first obtain the application's configuration file from the Apolo Console and convert it to the required JSON format.

Downloading the App Configuration File

This process generates a YAML configuration file based on the app's standard installation page, pre-filled with the Launchpad authentication settings.

1. Navigate to the App Installation Page: In the Apolo Console, go to the All Apps page and select the application you wish to import (e.g., Visual Studio Code). Click Install.

2. Configure Resource Presets: Select the necessary resource presets for the application.

3. Configure Authentication: Scroll down to the Networking Settings section and configure the HTTP Ingress:

   • Change the Authentication dropdown to Custom Authentication.

   • In the Custom Authentication section, click Choose App next to the AuthIngressMiddleware to integrate Launchpad.

   • Select the installed Launchpad instance and click Apply.

4. Download Configuration: Scroll to the bottom of the installation page. Click the Export App Configuration download icon (a down arrow pointing into a cloud or similar icon, typically next to the "Install" button) to download the .yaml configuration file. The following yaml file is an example Downloaded from the VSCode App installation page.

   display_name: ""
   template_name: vscode
   template_version: v25.10.1
   input:
       vscode_specific:
           override_code_storage_mount: null
       extra_storage_mounts: null
       mlflow_integration: null
       preset:
           name: cpu-small
       networking:
           ingress_http:
               auth: {
                   middleware: {
                       type: app-instance-ref, 
                       instance_id: "<launchpad-app-instance-id>", 
                       path: $.auth_middleware
                   }, 
                   type: custom_auth
               }

Converting the YAML Configuration to JSON

If you are using Launchpad API to import templates, follow the instructions below to convert the exported yaml file into json

The Launchpad API requires the app configuration payload to be in JSON format. Use a command-line tool like yq or a combination of cat and python to perform this conversion.

Method A: Using python

If you don't have yq, you can use Python's built-in YAML and JSON libraries:

1. Install PyYAML: If you haven't already, install the necessary library:

   pip install PyYAML

2. Run the Conversion Script:

   # Replace [FILE_NAME] with the name of your downloaded YAML file
   python -c "import yaml, json, sys; d=yaml.safe_load(sys.stdin.read()); print(json.dumps(d))" < [FILE_NAME].yaml

Method B: Using yq

If you have yq installed, this is the simplest method:

# Replace [FILE_NAME] with the name of your downloaded YAML file
cat [FILE_NAME].yaml | yq -o json

The output will be the single-line JSON string containing the app template data, which is ready to be used in the API call to import the template into Launchpad.

Here is the resulting json file.

{
  "display_name": "",
  "template_name": "vscode",
  "template_version": "v25.10.1",
  "input": {
    "vscode_specific": {
      "override_code_storage_mount": null
    },
    "extra_storage_mounts": null,
    "mlflow_integration": null,
    "preset": {
      "name": "cpu-small"
    },
    "networking": {
      "ingress_http": {
        "auth": {
          "middleware": {
            "type": "app-instance-ref",
            "instance_id": "<launchpad-app-instance-id>",
            "path": "$.auth_middleware"
          },
          "type": "custom_auth"
        }
      }
    }
  }
}

Deploying a Service Deployment App that uses Launchpad authentication

After installing Launchpad, you will be able to deploy Apps that require Launchpad authentication. This small guide will walk you through how you can deploy your custom application using the Service Deployment App.

• Navigate to Apolo Console's Home Page, find the Service Deployment app and click Install

• Choose a Resource Preset (e.g., cpu-small).

• Container Image: Provide a container image (e.g., nginx).

• Network Configuration:

  • Enable HTTP Ingress.

  • Change Authentication to Custom Authentication.

  • In Authentication Middleware, click Choose App and select Launchpad with the path

  • Install the application.

• Import this App Instance into Launchpad so that it enables authentication

  • Follow this guide for Admin Panel usage

  • Follow this guide for API usage

References

• Keycloak documentation

• OpenWebUI app documentation

• Managing Apps