glideinWMS ini file based installer

Description

MAJOR DISCLAIMER: This method of installation has NOT been officially released as yet. While it has been tested with V2.4+, keep that in mind

This installer uses a configuration file (ini format) to perform the installation of the glideinWMS services in lieu of a question/answer (q/a) type installer. It requires knowledge and planning of the glideinWMS services just as the the q/a installer did. The major difference is that you essentially pre-answer all the questions previously asked and document them in the ini file. In addition to having them documented, this performs the actual installation faster and allows for re-installs more quickly when some of the attribute values are incorrect (an inevitable consequence of a complex set of services such as these).

Another major difference, with this installer, is that it does NOT modify any scripts that set a user environment upon log in, e.g., .bashrc file, /etc/profile.d files, et al. Instead, an environment script is created for each service in its respective "home" location. If inclusion of these scripts is required at a location, it will need to be performed manually. The only exception to this is when privilege separation is in effect, in which case, the /etc/condor/privsep_config file is created. This location is hard-coded in Condor and cannot be changed.

Service Script Example
wmscollector
usercollector
submit
condor_location/condor.sh  
factory install_location/factory.sh  
vofrontend install_location/frontend.sh

Access via CVS

To access the branch for the ini-based installer:
export CVSROOT=cvsuser@cdcvs.fnal.gov:/cvs/cd
cvs -d :pserver:anonymous@cdcvs.fnal.gov:/cvs/cd_read_only co -r branch_v2plus  glideinWMS

the installation process - general comments

There are several general comments about the installation process that are probably good to understand before getting started.

NOTE: There is no upgrade process available from V1.6 to a V2+ version of glideinWMS. You must install from V2+ from scratch.

Installation sequence

There are some dependencies between the various services. So the order of installation is critical. They must be installed in this order:
  1. WMS Collector
  2. Factory
  3. User Collector
  4. Schedd/submit
  5. VOFrontend

IMPORTANT - This dependency between services also dictates that if you get an error during the installation that requires a change to the ini file. You should go back and re-install ALL services.

OSG/VDT client software

The vdt_location attribute identifies where the OSG/VDT client software is installed. If the OSG/VDT client software is used for a node, the installer verifies its existence based on the presence of 2 files:
  1. The *vdt_location*/setup.sh script
  2. The existence of a voms-proxy-init executable in the installation. This also implies that grid-proxy-init is also available.
If they already exist, the installer will not attempt to reinstall that software.

Pacman is used to install the OSG/VDT client software and the CA certificates if they are not already installed

manage-glideins script

The script used to perform the installations is glideinWMS/install/manage-glideins .

Usage: ./manage-glideins -- --ini <--debug>

action: install, start, stop, status
services: wmscollector usercollector factory submit vofrontend
all - can only be used with start/stop/status actions
--debug: When used with start/stop/status actions, it will
display the series of commands used.

This process can be used to install, start, stop or check the status of
the glidein services based on the configuration in the specified ini file.

The start/stop/status actions can be performed remotely providing the user
has valid access to the other service's node via the .k5login of that user.
For these actions, this process ssh's into the services node thereby insuring
a clean environment.

The install/install-node/create-entries can only be used on the node for that
service.

./manage-glideins --install-node --ini

This option allows you to install all services for the node you are installing
on. There are some limitation to this.

./manage-glideins --create-entries --ini

This option can be used to select new glidein entry points after the
initial installation of a factory service. If will walk you through the same
question and answer process querying ReSS and BDII for resources. It will then
create a file containing the entry elements for those selected. This can then
be merged with the existing Factory configuration file.

  • cd glideinWMS/install
  • ./manage-glideins --install service_name --ini inifile_location

The script can also be used to "remotely" start and stop glidein services. However, this assumes you have remote access (via ssh) to the other node/account.

glideinWMS ini file

All ini file attributes are required. However, in several cases the value may be left empty. These should be noted in the comments column of the tables.

Default section

The attributes in this section apply to all subsequent sections in the ini file unless they are overridden specifically in that section.

The 2 pacman related attributes are used to bring down the OSG/VDT client software and CA certificates if they are not already installed on the node. These should not be changed.

attribute Example Description Comments
pacman_version pacman-3.28 Version of pacman to use.  
pacman_url http://physics.bu.edu/pacman/sample_cache/tarballs URL to retrieve pacman.

PARAG:
MAKE THIS THE URL TO THE TARBALL SO WE CAN GET RID OF pacman_version IF IT IS STILL REQUIRED.
 

WMSCollector section

attribute Example Description Comments
node / hostname cms-xen21.fnal.gov hostname for WMS Collector. The WMS collector and Factory must be collocated at this time.
unix_acct / username condor (or whatever non-root user you decide on) UNIX user account that this services will run under. DO NOT use "root". Since this is a condor installation, for security purpose this should be installed as root user (although it is not required).

However, if privilege separation is being used, you MUST install as root user as the condor switchboard requires it.
service_name condor-wms Used in naming the condor startup script (condor_).
Example - condor-wms
This allows multiple glidein condor services to be used in init.d services with unique names.

This is also used in the condor_mapfile of the other glidein services as the 'nickname' to more easily identify the DNs in that file.
condor_location /home/weigand/glidein/condor-wms Directory in which the condor software will be installed.  
collector_port 9618 (condor default) Defines the Condor Collector port. Condor default is 9618. If multiple glidein services are installed on the same node, this should be unique of each service.
privilege_separation y Valid values:
* y - privilege separation is used
* n - privilege separation is not used
SHOULD BE A LINK IN HERE EXPLAINING THIS
frontend_users cms_jgw : vo_cms A comma separated list mapping the vofrontend's service name to the UNIX account that has been created for it.

The format for each frontend is:
service_name : unix account
Only used if privilege separation is used.

The UNIX account for each frontend MUST be created in advance.

The service name MUST be the value for the VOFrontend section's service_name attribute.
certificates/x509_cert_dir /home/weigand/glidein/vdt The parent directory where the CA certificates are maintained.

PARAG:
THIS SHOULD NOT BE PARENT DIR BUT DIRECTLY POINT TO THE CERTIFICATE DIR
 
gsi_authentication / gsi_credential_type cert Used to identify the WMS Collector to the other glidein services.
Valid values:
* cert - certificate used
* proxy - proxy used
 
cert_proxy_location /home/weigand/grid-security/cms-xen21glideincert.pem The location of the certificate or proxy (depending of the gsi_authentication value).

PARAG:
SPLIT IT
; Both should be defined if we gsi_credential_type is cert
; If type is proxy neither are required and we need user_proxy
x509_cert = /etc/grid-security/cmssrv97condorcert.pem
x509_key = /etc/grid-security/cmssrv97condorkey.pem
; x509_proxy = /tmp/user_proxy
If a certificate, all that is need needed is the cert file name, not the key.pem file (full path required)
eg. hostcert.pem
gsi_dn /DC=org/DC=doegrids/OU=Services/CN=glidein/cms-xen21.fnal.gov If the gsi_authentication is:
* cert, the subject of the certificate
* proxy, the issuer of the proxy
openssl x509 -issuer -subject -noout -in [cert_proxy_location]

This is used to populate the condor_config file GSI_DAEMON_NAME and condor_mapfile entries of this and the other glidein services.
condor_tarball /home/weigand/tarballs/condor-7.5.0-linux-x86-rhel3-dynamic.tar.gz Location of the condor tarball. It must be a zipped tarball. The installation script will perform the installation of condor.
condor_admin_email whomever@fnal.gov Used in the condor_config.local only.  
split_condor_config y Valid values:
* y - will create a CONDOR_LOCATION/condor_local/condor_config.local
* n - will append to the CONDOR_LOCATION/etc/condor_config
It is recommended that you split the condor_config file.
number_of_schedds 5 The desired number of schedds to be used.  
install_vdt_client y Valid values:
* y - installer will install a VDT client using the vdt_location and pacman options in the VDT section of the ini file.
* n - will not attempt to install the VDT client
If 'y' and the client already exists in the VDT vdt_location specified, it will not reinstall it.
vdt_location /home/weigand/glidein/vdt The location of the OSG/VDT client software. The installer looks for the existence of 2 files to verify it this is an OSG/VDT client installation:
1. setup.sh
2. existence of a voms-proxy-init executable.
pacman_location /home/weigand/glidein Parent directory for the pacman software.

PARAG:
CLARIFY IN DOCS THAT THIS WILL CREATE a pacman-xxx in this directory
The installer looks for the existence of 2 files to verify it this is an OSG/VDT client installation:
1. setup.sh
2. existence of a voms-proxy-init executable.
Pacman is used to install the OSG/VDT client software and the CA certificates if they are not already installed
glidein_install_dir / glideinwms_location /home/weigand/glideinWMS Directory of the glideinWMS software. Since this is a Condor service only, this software is only used during the installation process.

Factory section

attribute Example Description Comments
node cms-xen21.fnal.gov hostname for Factory. The WMS collector and Factory must be collocated at this time.
unix_acct weigand UNIX user account that this services will run under. Although the WMS Collector and Factory must be co-located, they can be run as independent users.
service_name factory-jgw Used as the 'nickname' for the GSI DN in the condor_mapfile of other services.  
install_location /home/weigand/glidein/factory HOME directory for the factory software.  
client_files / client_log_dir + client_proxy_dir /var/spool/factory-jgw This identifies the location of the client log and proxy files.

PARAG
; Validation: client_files
; Dir exists and/or we can create and write to it.
; Contains subdirs for clientlogs and clientproxies
; General comment: It's confusing when you name the variable as client_files.
; Prefer name change but don't have good name right now.
If privilege separation is used, then the entire path (inclusive of this directory) must be root-writable-only (0755 and owned by root).

If privilege separation is not used, then the directory will be created by the install script assuming the factory user has write permissions to the parent directory.
instance_name v2_2 Used in naming files and directories.  
gsi_authentication cert Used to identify the Factory to the other glidein services.
Valid values:
* cert - certificate used
* proxy - proxy used
Valid values: cert proxy
cert_proxy_location /home/weigand/grid-security/x509_pilot_xen21_cms_proxy The location of the certificate or proxy (depending on the gsi_authentication value). If a certificate, all that is need needed is the cert file name, not the key.pem file (full path required)
eg. hostcert.pem
gsi_dn /DC=org/DC=doegrids/OU=Services/CN=cmsxen21/cms-xen21.fnal.gov If the gsi_authentication is:
* cert, the subject of the certificate
* proxy, the issuer of the proxy
openssl x509 -issuer -subject -noout -in [cert_proxy_location]
use_vofrontend_proxy y Specifies if the VO frontend or factory proxy should be used THIS MAY BE OBSOLETE. ALWAYS SPECIFY 'y'.
use_glexec y Used to specify how user submitted jobs are authorized on the CE/WN node:
* y - downloads and uses gLexec
* n - pilot(glidein) proxy is used
With gLexec, the individual users proxy submitted with their job is used to authorize the job and is reflected in the accounting.
use_ccb n Valid values:
* y - uses CCB
* n - does not use CCB
 
gcb_list ????? PARAG:

WE MAYBE ABLE TO GET RID OF IT
OBSOLETE????
match_authentication y Valid values:
* y - uses it
* n - does not use it
DON'T REALLY KNOW WHAT THIS IS.
ress_host osg-ress-4.fnal.gov Identifies the ReSS server to be used to select Entry points (CEs) to submit glidein pilot jobs to.
The only validation performed is to verify if that server exists.
OSG values:
* osg-ress-1.fnal.gov - OSG production
* osg-ress-4.fnal.gov - OSG ITB
bdii_host exp-bdii.cern.ch Identifies the ReSS server to be used to select Entry points (CEs) to submit glidein pilot jobs to.
The only validation performed is to verify if that server exists.
exp-bdii.cern.ch is the only one I am aware of.
entry_vos cms, dzero A comma delimited set of VOs that should be used to select the entry points that glideins can be submitted to. These are the used as the initial criteria in querying ReSS and/or BDII for glidein entry points.
entry_filters (int(GlueCEPolicyMaxCPUTime? )<(25*60)) An additional entry point (CE) filter for insuring that specific resources are available. After the initial set of entry points have been selected using the 'entry_vos' criteria, these filters are applied.

The format is a python expression using Glue schema attributes.
install_vdt_client y Valid values:
* y - installer will install a VDT client using the vdt_location and pacman options in the VDT section of the ini file.
* n - will not attempt to install the VDT client
If 'y' and the client already exists in the VDT vdt_location specified, it will not reinstall it.
glidein_install_dir / glideinwms_location /home/weigand/glideinWMS Directory of the glideinWMS software. The glideinWMS software is used for both the installation of the various services and during the actual running of the glidein services.
web_location /var/www/html/factory_weigand Specifies the location for the monitoring and staging accessible by web services. This should be created before installing the Factory as the Factory user and the web server user are generally different and this script will not be able to create this directory with proper ownership.
web_url http://%(node)s Identifies the url used by the glidein pilots to download necessary software and to record monitoring data.  
javascriptrrd / javascriptrrd_location /home/weigand/glidein/utilities/javascriptrrd-0.5.0 Identifies the location of the javascript rrd software.  
flot / bye bye /home/weigand/glidein/utilities/javascriptrrd-0.5.0/flot Identifies the location of the flot software.

PARAG
; Validation: javascriptrrd_location
; We should only support javascriptrrd that is bundled with flot and maintained
; by Igor. There are possible incompatibilities trying when using external flot
; So look for existence of flot within the javascriptrrd_location and get
; rid of flot or flot_location
Note: With javascriptrrd-0.5.0, flot is now a part of that package. To verify, look for a flot directory in it's path.
m2crypto / m2crypto_location /bye bye /home/weigand/glidein/utilities/M2Crypt Identifies the location of the M2Crypto software.  
javascriptrrd_tarball /home/weigand/tarballs/javascriptrrd-0.5.0.tgz Identifies the location of a zipped tarball that can be used to install the javascriptrrd software. Only required if javascriptrrd is not already installed.
flot_tarball / bye bye   Identifies the location of a zipped tarball that can be used to install the flot software. Only required if flot is not already installed.
m2crypto_tarball / bye bye /home/weigand/tarballs/M2Crypto-0.19.1.tar.gz Identifies the location of a zipped tarball that can be used to install the M2Crypto software. Only required if M2Crypto is not already installed.

User collector section

attribute Example Description Comments
node cms-xen23.fnal.gov hostname for User Collector.  
unix_acct weigand UNIX user account that this services will run under. Since this is a condor installation, for security purpose this should be installed as root user (although it is not required).
service_name userpool Used in naming the condor startup script (condor_).
Example - condor_userpool
This allows multiple glidein condor services to be used in init.d services with unique names.
condor_location /home/weigand/glidein/condor-userpool Directory in which the condor software will be installed.  
collector_port 9618 (condor default) Defines the Condor Collector port. Condor default is 9618. If multiple glidein services are installed on the same node, this should be unique of each service.
certificates /home/weigand/glidein/vdt The parent directory where the CA certificates are maintained.  
gsi_authentication cert Used to identify the User Collector to the other glidein services.
Valid values:
* cert - certificate used
* proxy - proxy used
 
cert_proxy_location /home/weigand/grid-security/cms-xen23glideincert.pem The location of the certificate or proxy (depending of the gsi_authentication value). If a certificate, all that is need needed is the cert file name, not the key.pem file (full path required)
eg. hostcert.pem
gsi_dn /DC=org/DC=doegrids/OU=Services/CN=glidein/cms-xen23.fnal.gov If the gsi_authentication is:
* cert, the subject of the certificate
* proxy, the issuer of the proxy
openssl x509 -issuer -subject -noout -in [cert_proxy_location]

This is used to populate the condor_config file GSI_DAEMON_NAME and condor_mapfile entries of this and the other glidein services.
condor_tarball /home/weigand/tarballs/condor-7.5.0-linux-x86-rhel3-dynamic.tar.gz Location of the condor tarball. It must be a zipped tarball. The installation script will perform the installation of condor.
condor_admin_email whomever@fnal.gov Used in the condor_config.local only.  
split_condor_config y Valid values:
* y - will create a CONDOR_LOCATION/condor_local/condor_config.local
* n - will append to the CONDOR_LOCATION/etc/condor_config
It is recommended that you split the condor_config file.
number_of_secondary_collectors 5 The desired number of secondary collectors to be used.  
install_vdt_client y Valid values:
* y - installer will install a VDT client using the vdt_location and pacman options in the VDT section of the ini file.
* n - will not attempt to install the VDT client
If 'y' and the client already exists in the VDT vdt_location specified, it will not reinstall it.
glidein_install_dir /home/weigand/glideinWMS Directory of the glideinWMS software. Since this is a Condor service only, this software is only used during the installation process.

Submit section

attribute Example Description Comments
node cms-xen24.fnal.gov hostname for Submit node  
unix_acct weigand UNIX user account that this services will run under.  
service_name submit Used in naming the condor startup script (condor_).
Example - condor_submit
This allows multiple glidein condor services to be used in init.d services with unique names.
condor_location /home/weigand/glidein/condor-submit Directory in which the condor software will be installed.  
certificates /home/weigand/glidein/vdt The parent directory where the CA certificates are maintained.  
gsi_authentication cert Used to identify the User Collector to the other glidein services.
Valid values:
* cert - certificate used
* proxy - proxy used
 
cert_proxy_location /home/weigand/grid-security/cms-xen24glideincert.pem The location of the certificate or proxy (depending of the gsi_authentication value). If a certificate, all that is need needed is the cert file name, not the key.pem file (full path required)
eg. hostcert.pem
gsi_dn /DC=org/DC=doegrids/OU=Services/CN=glidein/cms-xen24.fnal.gov If the gsi_authentication is:
* cert, the subject of the certificate
* proxy, the issuer of the proxy
openssl x509 -issuer -subject -noout -in [cert_proxy_location]

This is used to populate the condor_config file GSI_DAEMON_NAME and condor_mapfile entries of this and the other glidein services.
condor_tarball /home/weigand/tarballs/condor-7.5.0-linux-x86-rhel3-dynamic.tar.gz Location of the condor tarball. It must be a zipped tarball. The installation script will perform the installation of condor.
condor_admin_email whomever@fnal.gov Used in the condor_config.local only.  
split_condor_config y Valid values:
* y - will create a CONDOR_LOCATION/condor_local/condor_config.local
* n - will append to the CONDOR_LOCATION/etc/condor_config
It is recommended that you split the condor_config file.
number_of_schedds 5 The desired number of schedds to be used.  
match_authentication y Valid values:
* y - uses it
* n - does not use it
DON'T REALLY KNOW WHAT THIS IS. OR HOW IT WORKS IN CONJUNCTION WITH FACTORY VALUE.

MAYBE THERE SHOULD BE JUST ONE IF THEY BOTH HAVE TO SAY Y OR N
install_vdt_client y Valid values:
* y - installer will install a VDT client using the vdt_location and pacman options in the VDT section of the ini file.
* n - will not attempt to install the VDT client
If 'y' and the client already exists in the VDT vdt_location specified, it will not reinstall it.
glidein_install_dir /home/weigand/glideinWMS Directory of the glideinWMS software. Since this is a Condor service only, this software is only used during the installation process.

VOFrontend section

attribute Example Description Comments
node / hostname cms-xen22.fnal.gov hostname for VOFrontend.  
unix_acct weigand UNIX user account that this services will run under.  
service_name cms_frontend Used as the 'nickname' for the GSI DN in the condor_mapfile.  
frontend_identity cms_frontend Used in the frontend config file to identify this VOFrontend to the factory  
install_location /home/weigand/glidein/cms HOME directory for the frontend software. When the frontend glideins are created the following files/directories will exist:
* frontend.sh - environment script
* instance_[instance_name].cfg - the configuration file for the factory.
* frontend_[service_name]_[instance_name] - directory containing the frontend files
logs_location / log_dir /home/cms/glidein/logs Provides a central location for all log files.

PARAG:
log_dir: Store frontend logs for frontend
Store factory logs for factory
Support this in factory as well
 
instance_name v2_2 Used in naming files and directories.  
condor_location /home/weigand/glidein/condor-submit Directory in which the condor software will be installed. Note: The Frontend never runs any Condor daemons. It only uses the Condor client tools.
condor_tarball /home/weigand/tarballs/condor-7.5.0-linux-x86-rhel3-dynamic.tar.gz Location of the condor tarball. It must be a zipped tarball. The installation script will perform the installation of condor.
condor_admin_email whomever@fnal.gov Used in the condor_config.local only.  
split_condor_config y Valid values:
* y - will create a CONDOR_LOCATION/condor_local/condor_config.local
* n - will append to the CONDOR_LOCATION/etc/condor_config
 
certificates /home/weigand/glidein/vdt The parent directory where the CA certificates are maintained.  
gsi_authentication proxy Valid values: proxy This must always be a proxy for the VO Frontend to communicate with the Factory.
cert_proxy_location /home/weigand/grid-security/x509_glidein_xen22_proxy The location of the proxy. I should just change this to 'proxy_location' and eliminate the gsi_authentication attribute.
gsi_dn /DC=org/DC=doegrids/OU=Services/CN=glidein/cms-xen22.fnal.gov This is the issuer of the proxy openssl x509 -issuer -noout -in [cert_proxy_location]
glidein_proxies / glidein_proxy_files /home/weigand/grid-security/x509_pilot_xen22_dzero_proxy /home/weigand/grid-security/x509_pilot_xen22_fermilab_proxy Identifies the proxy(s) to be used to submit the glidein pilot jobs.

When specifying multiple proxies, whitespace is the delimiter.
These will be the proxies used by the glidein pilot jobs if you have specified that Frontend proxies are to be used in the Factory section of this ini file.
glidein_proxies_dns / glidein_proxy_dns /DC=org/DC=doegrids/OU=Services/CN=dzeroxen22/cms-xen22.fnal.gov;/DC=org/DC=doegrids/OU=Services/CN=fermilabxen22/cms-xen22.fnal.gov Identifies the issuer(s) of the glidein_proxies being used.

This is a semicolon separated list for each proxy identified in the glidein_proxies attribute.

PARAG
CHECK FOR POSSIBLE DELIMETERS
I WILL AGREE WITH JOHN ON THE DELIMETER HE SELECTS
 
glexec_use required Valid values:
* required - will only request glidein pilots to entry points that use glexec
* optional - will request glidein pilots regardless of glexec use
* never - will never request glidein pilots for entry points using glexec
 
expose_grid_env True Valid values:
* True
* False
DON'T REALLY KNOW WHAT THIS IS.
match_authentication y Valid values:
* y - uses it
* n - does not use it
DON'T REALLY KNOW WHAT THIS IS. OR HOW IT WORKS IN CONJUNCTION WITH FACTORY VALUE.

MAYBE THERE SHOULD BE JUST ONE IF THEY BOTH HAVE TO SAY Y OR N
match_string True This must be the python format so exact case is critical. So if using a boolean, 'True/False' are case sensitive. DON'T REALLY KNOW WHAT THIS IS.
install_vdt_client y Valid values:
* y - installer will install a VDT client using the vdt_location and pacman options in the VDT section of the ini file.
* n - will not attempt to install the VDT client
If 'y' and the client already exists in the VDT vdt_location specified, it will not reinstall it.
glidein_install_dir /home/weigand/glideinWMS Directory of the glideinWMS software. The glideinWMS software is used for both the installation of the various services and during the actual running of the glidein services.
web_location /var/www/html/cms_frontend Specifies the location for the monitoring and staging accessible by web services. This should be created before installing the Frontend as the Frontend user and the web server user are generally different and this script will not be able to create this directory with proper ownership.
web_url http://%(node)s Identifies the url used by the glidein pilots to download necessary software and to record monitoring data.  
javascriptrrd /home/weigand/glidein/utilities/javascriptrrd-0.4.2 Identifies the location of the javascript rrd software.  
flot /home/weigand/glidein/utilities/flot Identifies the location of the flot software.  
m2crypto /home/weigand/glidein/utilities/M2Crypt Identifies the location of the M2Crypto software.  
javascriptrrd_tarball /home/weigand/tarballs/javascriptrrd-0.4.2.tgz Identifies the location of a zipped tarball that can be used to install the javascript rrd software. Only required if javascript rrd is not already installed.
flot_tarball /home/weigand/tarballs/flot-0.5.tar.gz Identifies the location of a zipped tarball that can be used to install the flot software. Only required if flot is not already installed.
m2crypto_tarball /home/weigand/tarballs/M2Crypto-0.19.1.tar.gz Identifies the location of a zipped tarball that can be used to install the M2Crypto software. Only required if M2Crypto is not already installed.

-- JohnWeigand - 09 Feb 2010

Topic revision: r17 - 2011/01/04 - 20:09:27 - JohnWeigand
 
This site is powered by the TWiki collaboration platformCopyright © by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback