Skip to content
This repository was archived by the owner on May 23, 2022. It is now read-only.

Commit 21a5d32

Browse files
timtheisentimtheisen
committed
Merge remote-tracking branch 'upstream/master'
2 parents 2d11627 + 75b9cbf commit 21a5d32

File tree

5 files changed

+97
-11
lines changed

5 files changed

+97
-11
lines changed

‎docs/other/install-cvmfs-stratum1.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ Before starting the installation process, consider the following points:
1111

1212
- **User IDs and Group IDs:** If your machine is also going to be a repository server like OSG Operations, the installation will create the same user and group IDs as the [cvmfs client](../worker-node/install-cvmfs.md). If you are installing frontier-squid, the installation will also create the same user id as [frontier-squid](../data/frontier-squid.md).
1313
- **Network ports:** This installation will host the stratum 1 on ports 80, 8000 and 8080, and if squid is installed it will host the uncached apache on port 8081. Port 80 is default but sometimes runs into operational problems, port 8000 is the alternate for most production use, and port 8080 is for Cloudflare (https://openhtc.io).
14-
- **Host choice:** - Make sure there is adequate disk space for the repositories that will be served, at `/srv/cvmfs`. About 10GB should be reserved for apache and squid logs under /var/log on a production server, although they normally will not get that large.
14+
- **Host choice:** - Make sure there is adequate disk space for all the repositories that will be served, at `/srv/cvmfs`. In addition, about 100GB should be reserved for apache and squid logs under /var/log on a production server, although they normally will not get that large. Apache logs get larger than squid logs because by default they are rotated much less frequently. Many installations share that space with the filesystem used for /srv/cvmfs by turning that directory along with /var/log/squid and /var/log/httpd into symlinks pointing to directories on the big filesystem.
1515
- **SELinux** - Ensure SELinux is disabled
1616

1717
As with all OSG software installations, there are some one-time (per host) steps to prepare in advance:
@@ -114,8 +114,8 @@ insertline("^http_access deny all", "acl CVMFSAPI urlpath_regex ^/cvmfs/[^/]*/ap
114114
insertline("^http_access deny all", "cache deny !CVMFSAPI")
115115
116116
# port 80 is also supported, through an iptables redirect
117-
setoption("http_port", "8000 accel defaultsite=localhost:8081 no-vhost")
118-
insertline("TAG: http_port","http_port 8080 accel defaultsite=localhost:8081 no-vhost")
117+
setoption("http_port", "8080 accel defaultsite=localhost:8081 no-vhost")
118+
insertline("^http_port","http_port 8000 accel defaultsite=localhost:8081 no-vhost")
119119
setoption("cache_peer", "localhost parent 8081 0 no-query originserver")
120120
121121
# allow incoming http accesses from anywhere

‎docs/release/osg-36.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,11 @@ The following issues are known to currently affect packages distributed in OSG 3
2525

2626
### HTCondor-CE ###
2727

28-
- If you are using HTCondor from the Upcoming repository,
28+
- `default_CERequirements` in the the new Job Router ClassAd transform syntax is ignored.
29+
To fix this, apply the change in [this patch](https://github.com/htcondor/htcondor-ce/pull/530/files) to
30+
`/usr/share/condor-ce/config.d/01-ce-router-defaults.conf`.
31+
The next release of HTCondor-CE will contain this fix and will not require any additional action post-update.
32+
- If you are using HTCondor from the 3.6 Upcoming repository,
2933
C-style comments, e.g. `/* comment */`, in `JOB_ROUTER_ENTRIES` will prevent the JobRouter from routing jobs
3034
([HTCONDOR-864](https://opensciencegrid.atlassian.net/browse/HTCONDOR-864)).
3135
For the time being, remove any comments if you are still using the

‎docs/release/supported_platforms.md

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,14 @@ Supported Platforms
44
The OSG [release series](../release/release_series.md) are supported on Red Hat Enterprise Linux (RHEL) compatible platforms
55
for 64-bit Intel architectures according to the following table:
66

7-
!!! note
8-
As of July 2020, only of a subset of the software stack is supported on RHEL 8-compatible platforms.
9-
You can track packages released for EL8 through our [release notes](../release/notes.md).
10-
117
| Platform | OSG 3.5 | OSG 3.6 |
128
|----------------------------|---------|---------|
139
| CentOS 7 | ✅ | ✅ |
14-
| CentOS 8 | ✅ | ✅ |
10+
| CentOS Stream 8 | ✅ | ✅ |
11+
| Alma Linux 8 | ✅ | ✅ |
1512
| Red Hat Enterprise Linux 7 | ✅ | ✅ |
1613
| Red Hat Enterprise Linux 8 | ✅ | ✅ |
14+
| Rocky Linux 8 | ✅ | ✅ |
1715
| Scientifix Linux 7 | ✅ | ✅ |
1816

1917
OSG builds and tests its RPMs on the latest releases of the relevant platforms (e.g., in 2021, the RHEL 7 builds were based on RHEL 7.9).

‎docs/release/updating-to-osg-36.md

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ If you have verified that your VO(s) support token-based pilot submission and HT
1616
use this document to update your OSG software to OSG 3.6.
1717

1818
Many software packages, such as HTCondor and HTCondor-CE, use Python 3 scripts. If you are using Enterprise Linux 7,
19-
you must upgrade to at least version 7.8 to get Python 3 support.
19+
you must upgrade to at least version 7.8 for Python 3 support.
2020

2121
Updating the OSG Repositories
2222
-----------------------------
@@ -219,8 +219,14 @@ To update OSG-Configure, perform the following steps:
219219

220220
#### HTCondor-CE ####
221221

222+
!!! bug "Passing along non-HTCondor batch system directives"
223+
`default_CERequirements` in the the new Job Router ClassAd transform syntax is ignored.
224+
To fix this, apply the change in [this patch](https://github.com/htcondor/htcondor-ce/pull/530/files) to
225+
`/usr/share/condor-ce/config.d/01-ce-router-defaults.conf`.
226+
The next release of HTCondor-CE will contain this fix and will not require any additional action post-update.
227+
222228
!!! bug "Remove comments from `JOB_ROUTER_ENTRIES`"
223-
If you are using HTCondor from the Upcoming repository,
229+
If you are using HTCondor from the 3.6 Upcoming repository,
224230
C-style comments, e.g. `/* comment */`, in `JOB_ROUTER_ENTRIES` will prevent the JobRouter from routing jobs
225231
([HTCONDOR-864](https://opensciencegrid.atlassian.net/browse/HTCONDOR-864)).
226232
For the time being, remove any comments if you are still using the

‎docs/security/tokens/overview.md

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
DateReviewed: 2022-03-10
2+
3+
Bearer Token Overview
4+
=====================
5+
6+
7+
8+
9+
Validating Tokens in Pilot Jobs
10+
-------------------------------
11+
12+
If an incoming (pre-routed) pilot on a CE has a token, it will have the following classad attributes:
13+
14+
| Attribute | Meaning |
15+
|------------------|-------------------------------------|
16+
| AuthTokenId | A UUID of the token |
17+
| AuthTokenIssuer | The URL of the issuer of the token |
18+
| AuthTokenScopes | Any scope restrictions on the token |
19+
| AuthTokenSubject | The 'sub' field of the token |
20+
21+
(A pre-routed job is a job without `RoutedJob=True` in its classad.)
22+
23+
!!! note
24+
A job may have both a token and an X.509 proxy.
25+
Presence of any `x509*` attributes does not indicate the absence of a token.
26+
27+
To see which authentication method was used for a job:
28+
- Examine the `/var/log/condor-ce/AuditLog*` files.
29+
- Find a line saying `Submitting new job <JOBID>` (where `<JOBID>` is a job ID like `21249.0`).
30+
The line before that should say what authentication method was used.
31+
- Authentication via a token will say `AuthMethod=SCITOKENS`.
32+
- Authentication via a proxy will say `AuthMethod=GSI`.
33+
34+
See the [upstream documentation](https://htcondor.com/htcondor-ce/v5/troubleshooting/common-issues/#jobs-fail-to-submit-verify-scitoken-contents)
35+
for more details.
36+
37+
Collaboration support
38+
---------------------
39+
40+
!!! info "Verify support with collaborations"
41+
The tables of collaborations below are updated as frequently as possible.
42+
If a collaboration you support is listed as not supporting tokens or WebDav, please contact your collaboration
43+
directly to verify that this information is up-to-date.
44+
45+
### Pilot job submission ###
46+
47+
These are the collaborations that support or partially support using tokens for pilot submission:
48+
49+
| Collaboration | Supports Bearer Tokens |
50+
|:--------------|------------------------|
51+
| ATLAS | Undergoing testing |
52+
| CLAS12 | Undergoing testing |
53+
| CMS | Undergoing testing |
54+
| EIC | Undergoing testing |
55+
| GLOW | Yes |
56+
| GlueX | Undergoing testing |
57+
| IceCube | Undergoing testing |
58+
| LIGO | Undergoing testing |
59+
| OSG | Yes |
60+
61+
Until all of the collaborations you support are using tokens in production, your CE should remain on OSG 3.5,
62+
with the 3.5-upcoming repositories enabled.
63+
64+
### WebDAV/XRootD File transfer ###
65+
66+
The following collaborations support support file transfer using WebDAV or XRootD:
67+
68+
| Collaboration | Supports WebDAV or XRootD |
69+
|:--------------|---------------------------|
70+
| ATLAS | Yes |
71+
| CMS | Yes |
72+
| CLAS12 | Yes |
73+
| EIC | N/A |
74+
| GLOW | N/A |
75+
| GlueX | No |
76+
| IceCube | Undergoing testing |
77+
| LIGO | Undergoing testing |
78+
| OSG | N/A |

0 commit comments

Comments
 (0)