Skip to content

Commit 6965a6f

Browse files
dietrichlikodietrichliko
committed
Remove condercert ....
1 parent 4da22f4 commit 6965a6f

21 files changed

+327
-21
lines changed

‎.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
__pycache__
2+
*.swp
3+
*.pyc
4+
default_junit.xml

‎.gitlab-ci.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
centos7:
3+
tags:
4+
- dood
5+
image: gitlab-registry.cern.ch/hephyvienna/docker/centos7-molecule:latest
6+
variables:
7+
ROLE: hephyvienna.grid-htc-ce
8+
before_script:
9+
- ln -s $CI_PROJECT_NAME ../$ROLE
10+
script:
11+
- docker --version
12+
- python --version
13+
- ansible --version
14+
- molecule --version
15+
- molecule test
16+
- junit2html default_junit.xml default_junit.html
17+
artifacts:
18+
reports:
19+
junit: default_junit.xml
20+
paths:
21+
- default_junit.xml
22+
- default_junit.html

‎defaults/main.yml

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,16 @@
33
grid_htc_ce_repo_install: true
44
grid_htc_ce_repo_development_enable: false
55
grid_htc_ce_batch_system: slurm
6-
grid_htc_ce_pkgs:
7-
- htcondor-ce-bdii
8-
- htcondor-ce-client
9-
- htcondor-ce-view
10-
- htcondor-ce
11-
- "htcondor-ce-{{ grid_htc_ce_batch_system }}"
6+
grid_htc_ce_enable_static_shadow: true
7+
grid_htc_ce_enable_bdii: true
8+
grid_htc_ce_uid_domain: {{ ansible_domain }}
9+
grid_htc_ce_condor_view_hosts: []
10+
grid_htc_ce_pool_collector_str: ''
11+
grid_htc_ce_gsi_regexp: '^\/DC\=ch\/DC\=cern\/OU\=computers\/CN\=(host\/)?([A-Za-z0-9.\-]*)$'
12+
grid_htc_ce_benchmark_result: 10.00-HEP-SPEC06
13+
grid_htc_ce_execution_env_cores: 16
14+
grid_htc_ce_election_hosts:
15+
- {{ ansible_fqdn }}
16+
grid_htc_ce_argus_server:
17+
grid_htc_ce_argus_port: 8154
18+
grid_htc_ce_argus_resourceid: http://authz-interop.org/xacml/resource/resource-type/ce

‎files/condor-ce.sysconfig

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
##############################################################################
2+
#
3+
# Condor-CE environment configuration.
4+
#
5+
# This file is sourced prior to starting the Condor-CE daemons. Add any
6+
# special configurations you might deem necessary. Prior to sourcing this
7+
# file, /usr/libexec/condor-ce/condor_ce_env_bootstrap is sourced.
8+
#
9+
# Condor-CE upgrades will not change this file.
10+
#
11+
##############################################################################
12+
13+
# Example: the base condor install for this host has been relocated into
14+
# /opt/condor
15+
# export PATH=/opt/condor/bin:/opt/condor/sbin:$PATH
16+
17+
# Example: Have GSI authorization use a different plugin for Condor than the
18+
# rest of the system.
19+
export GSI_AUTHZ_CONF=/etc/grid-security/gsi-authz.conf
20+
export GSI_PEP_CALLOUT_CONF=/etc/grid-security/gsi-pep-callout-condor.conf
21+
22+
# Example: Have the HTCondor-CE use a different hostname from the rest of
23+
# the system.
24+
# export CONDORCE_HOSTNAME=condorce.example.com

‎files/job-routes.conf

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#####################################################
2+
# Example Job Route
3+
#
4+
# This is an extraordinarily simple job route.
5+
# All it does is route local condor and set a
6+
# simple Accounting Group and default RequestMemory.
7+
#####################################################
8+
9+
# No custom functions for job router entries; these are causing crashes in 8.3.5.
10+
# Can remove the eval_set_environment attribute below starting in 8.3.8.
11+
JOB_ROUTER_ENTRIES = \
12+
[ \
13+
eval_set_environment = debug(strcat("HOME=/tmp CONDORCE_COLLECTOR_HOST=", CondorCECollectorHost, " ", \
14+
ifThenElse(orig_environment is undefined, osg_environment, \
15+
strcat(osg_environment, " ", orig_environment) \
16+
))); \
17+
TargetUniverse = 5; \
18+
name = "Local_Condor"; \
19+
eval_set_AccountingGroup = strcat("group_u_", x509userproxyvoname, ".", Owner); \
20+
delete_SUBMIT_Iwd = true; \
21+
set_WantIOProxy = true; \
22+
set_default_maxMemory = 3000; \
23+
]

‎handlers/main.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,5 @@
11
---
22
# handlers file for hephyvienna.htcondor-ce
3+
- name: reconfigure condor_ce
4+
command: /usr/bin/condor_ce_reconfig
5+
when: not service_bdii.changed | default(true) or not service_condor-ce

‎molecule/default/files/dummy.crt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
dummy crt

‎molecule/default/files/dummy.key

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
dummy key

‎molecule/default/molecule.yml

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,24 @@ lint:
77
name: yamllint
88
platforms:
99
- name: instance
10-
image: centos:7
10+
image: centos/systemd
11+
capabilities:
12+
- SYS_ADMIN
13+
tmpfs:
14+
- /tmp
15+
- /run
16+
volume_mounts:
17+
- /sys/fs/cgroup:/sys/fs/cgroup:ro
18+
command: /usr/sbin/init
1119
provisioner:
1220
name: ansible
1321
lint:
1422
name: ansible-lint
1523
verifier:
1624
name: testinfra
25+
options:
26+
# FIXME
27+
W: ignore::DeprecationWarning
28+
junit-xml: ../../default_junit.xml
1729
lint:
1830
name: flake8

‎molecule/default/playbook.yml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,42 @@
11
---
22
- name: Converge
33
hosts: all
4+
vars:
5+
poolaccounts:
6+
- name: 'cms%d.d3'
7+
uid: 10000
8+
number: 100
9+
comment: 'Standard User of the CMS VO'
10+
group: cms
11+
gid: 10000
12+
- name: 'cmsprd%d.d3'
13+
uid: 11000
14+
number: 10
15+
comment: 'Production User of the CMS VO'
16+
group: cmsprd
17+
gid: 11000
18+
groups: cms
19+
- name: 'cmspil%d.d3'
20+
uid: 12000
21+
number: 10
22+
comment: 'Pilot User of the CMS VO'
23+
group: cmspil
24+
gid: 10000
25+
groups: cms
26+
- name: 'cmssgm'
27+
uid: 13000
28+
comment: 'SW User of the CMS VO'
29+
group: cmssgm
30+
gid: 11000
31+
groups: cms
32+
grid_enable_repo: false
33+
grid_site_name: Hephy-Vienna
34+
grid_vos:
35+
- cms
36+
grid_host_certificate:
37+
cert: files/dummy.crt
38+
key: files/dummy.key
439
roles:
40+
- role: hephyvienna.poolaccounts
41+
- role: hephyvienna.grid
542
- role: hephyvienna.grid-htc-ce

‎molecule/default/requirements.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
- src: geerlingguy.repo-epel
3+
- src: git+https://gitlab.cern.ch/hephyvienna/ansible/role-grid.git
4+
name: hephyvienna.grid
5+
- src: git+https://gitlab.cern.ch/hephyvienna/ansible/role-poolaccounts.git
6+
name: hephyvienna.poolaccounts

‎tasks/auth-argus.yml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
- name: Install argus packages
3+
package:
4+
name:
5+
- argus-pep-api-c
6+
- argus-gsi-pep-callout
7+
state: present
8+
9+
- name: Configure gsi-authz
10+
copy:
11+
src: files/gsi-authz.conf
12+
dest: /etc/grid-security/gsi-authz.conf
13+
14+
- name: Configure gsi-pep-callout-condor
15+
template:
16+
src: gsi-pep-callout-condor.conf.j2
17+
dest: /etc/grid-security/gsi-pep-callout-condor.conf

‎tasks/bdii.yml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
- name: Install BDII
3+
package:
4+
name: htcondor-ce-bdii
5+
6+
- name: Configure BDII
7+
template:
8+
sec: ce-bdii.conf.j2
9+
dest: /etc/condor-ce/config.d/06-ce-bdii.conf
10+
notify: reconfigure condor_ce
11+
12+
- name: Start BDII
13+
service:
14+
name: bdii
15+
state: started
16+
enabled: true
17+
register: service_bdii

‎tasks/htcondor-ce.yml

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
- name: Install pkgs
3+
package:
4+
name:
5+
- htcondor-ce-client
6+
- htcondor-ce-view
7+
- htcondor-ce
8+
- "htcondor-ce-{{ grid_htc_ce_batch_system }}"
9+
10+
- name: Copy certificates
11+
copy:
12+
src: "/etc/grid-security/{{ item.src }}"
13+
dest: "/etc/grid-security/{{ item.dest }}"
14+
remote_src: true
15+
owner: condor
16+
group: condor
17+
loop:
18+
- src: hostcert.pem
19+
dest: condorcert.pem
20+
- src: hostkey.pem
21+
dest: condorkey.pem
22+
23+
- name: Configure site security
24+
template:
25+
src: ce-site-security.conf.j2
26+
dest: /etc/condor-ce/config.d/59-site-security.conf
27+
notify: reconfigure condor_ce
28+
29+
- name: Configure main CE
30+
template:
31+
src: configured-attributes.conf.j2
32+
dest: /etc/condor-ce/config.d/60-configured-attributes.conf
33+
notify: reconfigure condor_ce
34+
35+
- name: Configure job routes
36+
copy:
37+
src: job-routes.conf
38+
dest: /etc/condor-ce/config.d/61-job-routes.conf
39+
notify: reconfigure condor_ce
40+
41+
- name: Configure condor mapfile
42+
template:
43+
src: condor_mapfile.j2
44+
dest: /etc/condor-ce/condor_mapfile
45+
notify: reconfigure condor_ce
46+
47+
- name: Configure condor sysconfig
48+
copy:
49+
src: condor-ce.sysconfig
50+
dest: /etc/sysconfig/condor-ce
51+
52+
- name: Enable static shadow
53+
include_tasks: static-shadow.yml
54+
when: grid_htc_ce_enable_static_shadow
55+
56+
- name: Enable argus authorisation
57+
include_tasks: auth-argus.yml
58+
when: grid_htc_argus | length > 0
59+
60+
- name: Start HTCondor CE
61+
service:
62+
name: condor-ce
63+
state: started
64+
enabled: true
65+
register: service_condor-ce

‎tasks/main.yml

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,9 @@
44
include_tasks: repos.yml
55
when: grid_htc_ce_repo_install
66

7-
- name: Install pkgs
8-
package:
9-
name: "{{ grid_htc_ce_pkgs }}"
7+
- name: Install HTCondor CE
8+
include_tasks: htcondor-ce.yml
109

11-
- name: Configure gsi-authz
12-
copy:
13-
src: files/gsi-authz.conf
14-
dest: /etc/grid-security/gsi-authz.conf
15-
16-
- name: Configure gsi-pep-callout-condor
17-
template:
18-
src: gsi-pep-callout-condor.conf.j2
19-
dest: /etc/grid-security/gsi-pep-callout-condor.conf
10+
- name: Install BDII
11+
include_tasks: bdii.yml
12+
when: grid_htc_ce_enable_bdii

‎tasks/static-shadow.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
- name: Install static shadow packages
3+
package:
4+
name: condor-static-shadow
5+
state: present
6+
7+
- name: Configure static shadows
8+
copy:
9+
content: "SHADOW = $(SBIN)/condor_shadow_s\n"
10+
dest: etc/condor/config.d/41_ce_shadow.conf

‎templates/ce-bdii.conf.j2

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
2+
##############################################################################
3+
#
4+
# HTCondor-CE BDII/GLUE Publication configuration file.
5+
#
6+
##############################################################################
7+
8+
# For multi-CE sites, only one CE publishes certain values.
9+
{% if grid_htc_ce_election_hosts | length > 1 %}
10+
HTCONDORCE_BDII_ELECTION = ZOOKEEPER
11+
HTCONDORCE_BDII_ZKHOSTS = {{ grid_htc_ce_election_hosts | sort | join(',') }}
12+
{% else %}
13+
HTCONDORCE_BDII_ELECTION = LEADER
14+
HTCONDORCE_BDII_LEADER = {{ grid_htc_ce_election_hosts[0] }}
15+
{% end %}
16+
17+
# BDII Static Info and VOs
18+
HTCONDORCE_VONames = {{ grid_vos | sort | join(', ') }}
19+
HTCONDORCE_SiteName = {{ grid_site_name }}
20+
HTCONDORCE_HEPSPEC_INFO = {{ grid_htc_ce_benchmark_result }}
21+
HTCONDORCE_CORES = {{ grid_htc_ce_execution_env_cores }} # cores per node

‎templates/ce-site-security.conf.j2

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{ ansibleManaged | comment }}
2+
## Allow local condor daemons to be recognised as friendly
3+
UID_DOMAIN = {{ grid_htc_ce_uid_domain }}
4+
FRIENDLY_DAEMONS = $(FRIENDLY_DAEMONS), $(FULL_HOSTNAME)@$(UID_DOMAIN)/$(FULL_HOSTNAME), *@$(UID_DOMAIN), condor@$(UID_DOMAIN)/$(FULL_HOSTNAME), condor@child/$(FULL_HOSTNAME)
5+
## Recognise users from your site
6+
USERS = $(USERS), *@$(UID_DOMAIN)
7+
## Allow local daemons to write to the CE schedd
8+
ALLOW_DAEMON = $(ALLOW_DAEMON), $(FRIENDLY_DAEMONS)
9+
SCHEDD.ALLOW_WRITE = $(SCHEDD.ALLOW_WRITE), $(FULL_HOSTNAME)@$(UID_DOMAIN)/$(FULL_HOSTNAME), *@$(UID_DOMAIN)
10+
COLLECTOR.ALLOW_ADVERTISE_MASTER = $(COLLECTOR.ALLOW_ADVERTISE_MASTER), $(FRIENDLY_DAEMONS), *@$(UID_DOMAIN)
11+
COLLECTOR.ALLOW_ADVERTISE_SCHEDD = $(COLLECTOR.ALLOW_ADVERTISE_SCHEDD), $(FRIENDLY_DAEMONS), *@$(UID_DOMAIN)
12+
COLLECTOR.ALLOW_ADVERTISE_STARTD = $(COLLECTOR.ALLOW_ADVERTISE_STARTD), $(FRIENDLY_DAEMONS), *@$(UID_DOMAIN)
13+
## Local daemons need to be able to negotiate
14+
SCHEDD.ALLOW_NEGOTIATOR = $(SCHEDD.ALLOW_NEGOTIATOR), $(FULL_HOSTNAME)@$(UID_DOMAIN)/$(FULL_HOSTNAME), *@$(UID_DOMAIN)
15+
## Allow administrator access to CE daemons
16+
ALLOW_ADMINISTRATOR = $(ALLOW_ADMINISTRATOR), $(FULL_HOSTNAME)@$(UID_DOMAIN)/$(FULL_HOSTNAME)

‎templates/condor_mapfile.j2

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
GSI "^\/DC\=com\/DC\=DigiCert-Grid\/O=Open Science Grid\/OU\=Services\/CN\=(host\/)?([A-Za-z0-9.\-]*)$" \2@daemon.opensciencegrid.org
2+
GSI "^\/DC\=DigiCert-Grid\/DC\=com\/O=Open Science Grid\/OU\=Services\/CN\=(host\/)?([A-Za-z0-9.\-]*)$" \2@daemon.opensciencegrid.org
3+
GSI "^\/DC\=org\/DC\=opensciencegrid\/O=Open Science Grid\/OU\=Services\/CN\=(host\/)?([A-Za-z0-9.\-]*)$" \2@daemon.opensciencegrid.org
4+
GSI "^\/DC=ch\/DC=cern\/OU=computers\/CN=?([A-Za-z0-9.\-]*)$" \1@cern.ch
5+
GSI "{{ grid_htc_ce_gsi_regexp }}" \1@{{ grid_htc_ce_uid_domain }}
6+
GSI (.*) GSS_ASSIST_GRIDMAP
7+
GSI "(/CN=[-.A-Za-z0-9/= ]+)" \1@unmapped.opensciencegrid.org
8+
CLAIMTOBE .* anonymous@claimtobe
9+
FS (.*) \1

‎templates/configured-attributes.conf.j2

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Condor View Hosts routes your collector information to global or site collectors
2+
CONDOR_VIEW_HOST = {{ grid_htc_ce_condor_view_hosts | join(', ') }}
3+
4+
# Disable problematic shared library
5+
CLASSAD_USER_LIBS=
6+
7+
# Set appropriate place to route.
8+
JOB_ROUTER_SCHEDD2_NAME = {{ ansible_fqdn }}
9+
JOB_ROUTER_SCHEDD2_POOL = {{ grid_htc_ce_pool_collector_str }}
10+
11+
# No reason to hide jobs from view on CE
12+
CONDOR_Q_ONLY_MY_JOBS = False
13+
14+
# Cache Argus lookups for 2 hours.
15+
GSS_ASSIST_GRIDMAP_CACHE_EXPIRATION=7200
16+
17+
SCHEDD_COLLECT_STATS_BY_VO = x509userproxyvoname
18+
STATISTICS_TO_PUBLISH = SCHEDD:2

‎templates/gsi-pep-callout-condor.conf.j2

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
pep_ssl_server_capath /etc/grid-security/certificates/
22
pep_ssl_client_cert /etc/grid-security/condorcert.pem
33
pep_ssl_client_key /etc/grid-security/condorkey.pem
4-
pep_url https:{{ grid_htc_ce_argus_server }}:8154/authz
4+
pep_url https://{{ grid_htc_ce_argus_server }}:{{ grid_htc_ce_argus_port }}/authz
55
pep_timeout 30 # seconds
6-
xacml_resourceid http:{{ grid_htc_ce_argus_server }}/condor-ce
6+
xacml_resourceid {{ grid_htc_ce_argus_resourceid }}

0 commit comments

Comments
 (0)