deploy.md

How to deploy Mariner in a Gen3 environment

Prereq's

1. Mariner depends on the Workspace Token Service (WTS) to access data from the commons. If WTS is not already running in your environment, deploy the WTS.

2. Add the Mariner pieces to your manifest:

   1. Add version
   2. Add config

Deployment

3. Deploy the Mariner server by running gen3 kube-setup-mariner

Auth and User YAML

4. Mariner utilizes Gen3's policy engine, Arborist, for authorization. Make sure you have the following Mariner auth scheme in your User YAML:

   1. Policy

          - id: 'mariner_admin'
            description: 'full access to mariner API'
            resource_paths: ['/mariner']
            role_ids: ['mariner_admin']

   2. Resource

          - name: 'mariner'
            description: 'workflow execution service'

   3. Role

          - id: 'mariner_admin'
            permissions:
              - id: 'mariner_access'
                action:
                  service: 'mariner'
                  method: 'access'

5. Give the mariner_admin policy to those users who need it.

    policies:
    - mariner_admin

Auth Note

Right now the Mariner auth scheme is atomic - you either have access to all the API endpoints or none of them. In order for a user to interact with Mariner, that user will need to have Mariner admin privileges.

A Mariner admin can do the following:

• Run workflows
• Fetch run status via runID
• Fetch run logs and output via runID
• Cancel a run that's in-progress via runID
• Query run history (i.e., fetch a list of all your runIDs)