Add token authentication support #12196
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Jenkins results:
|
|
Jenkins results:
|
|
Jenkins results:
|
|
retest this please |
|
Jenkins results:
|
|
I tested the stage-in with the following workflow: The The wmAgent logfiles show the CMSSW run executed successfully and stageOut/dqmUpload failed afterwards. E.g.: job2: |
amaltaro
reviewed
Dec 13, 2024
There was a problem hiding this comment.
Kenyi, Andrea, it is not clear to me if this is a test and/or development in progress or not. I suspect you are still working on this, so I am labeling this according to make it clear and avoid mistakes (please remove the label once it's ready for a final review/merge).
In addition, please let me know if you wanted me to look into anything specific. I do not have anything else to add here and changes are looking alright.
|
@amaltaro This has been tested for stage-in and it is working. However, it depends on condor to be properly setup, otherwise condor will still submit but they will fail with: Therefore, code review is fine, but we cannot merge until the condor setup is fully defined (as far as I know, there is some automation related development going on regarding this) and deployed in all condor schedds. |
|
Jenkins results:
|
|
Jenkins results:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #12199
Needed for #12144
Status
tested
But external dependency is not completed (condor)
Description
This does not completely fixes #12144
This is needed to enable token authentication in WMAgent.
Stage-in should be functional with this fix
Stage-out will require changes in the stageout commands
Is it backward compatible (if not, which system it affects?)
YES
Related PRs
None
External dependencies / deployment changes
HTCondor token setup
htgettoken (optional) in the CMS runtime image.
Note: The HTCondor token setup is not deployed in all schedds yet.
Additional notes
There is a variable called $BEARER_TOKEN_FILE that if set, HTCondor will write the token there.
This would need to be setup in the host, not the WMAgent container.
This step is however, not critical because this is the reference token.
The actual token that HTCondor transfers comes from
which is in a private system area.
This can be changed in the condor configuration to directly write to
/data/certsin the future.When jobs are submitted via the condor python bindings, inside the WMAgent container, the job is submitted, but /usr/bin/condor_vault_storer does not seem to be triggered.
I am currently working that around by:
Executing a condor_submit with a test job once from the host
Token seems to stay and refresh afterwards
If cms_readonly scope is used, this does not happen and we need a manual refresh, but for production, we don't need any scope.