Re: [HTCondor-users] Myproxy usage clarification

[Steven C Timm <timm@xxxxxxxx>]

We use myproxy at Fermilab but we do it on the schedd side.  We have a dedicated myproxy server from which only our condor_schedd's can

do myproxy-get-delegation and there is a cron that runs on the schedd to get a new proxy every 12 hours or so, we then let htcondor transmit the

updated proxy to the worker node when the job is running.  This way the users don't have to make sure every job has the right myproxy delegation syntax

in their job.

Steve Timm

---

From: HTCondor-users <htcondor-users-bounces@xxxxxxxxxxx> on behalf of Gabriele Fronzé <gabriele.fronze@xxxxxxxxxx>
Sent: Monday, December 2, 2019 9:18 AM
To: htcondor-users@xxxxxxxxxxx <htcondor-users@xxxxxxxxxxx>
Subject: [HTCondor-users] Myproxy usage clarification

 

Hello everyone,

This is my first message to this users mailing list, so I’d like to say hello to everybody!

I work in the Virgo-LIGO collaboration from the Virgo side and I handle the infrastructural part of offline computing and storage.

I am working on porting a computing task that used to (and still does) run on LSF towards running on an HTC cluster installed in Bologna (CNAF).

One issue I was dealing with was the certificate expiration before computing ended, caused by un-extendible and expiring VOMS extensions.

I just started testing it using the CNAF MyProxy server to delegate proxy renewal and I’d like to know wether I setup everything correctly or not.

The steps I followed are:

• myproxy-init on the submit node, picking my custom password (e.g. dummypasswd). The command returns "A proxy valid for 168 hours (7.0 days) for user gfronze now exists on myproxy.cnaf.infn.it” so I suppose gfronze is my MyProxyCredentialName value.
• The submit file contains all the following settings:

use_x509userproxy = true

MyProxyCredentialName = gfronze

MyProxyPassword = dummypasswd

MyProxyHost = myproxy.cnaf.infn.it:7512

MyProxyNewProxyLifetime = 2880

MyProxyRefreshThreshold = 600

• The line "use_x509userproxy = true” was necessary to be able to submit the jobs. My understanding is that I should still launch the jobs using my own proxy, while HTC should contact MyProxy whenever needed to rearm the personal proxy. Am I correct?
• voms-proxy-init on the submit node.
• Launch the computing job via "condor_submit -pool ce02-htc.cr.cnaf.infn.it:9619 -remote ce02-htc.cr.cnaf.infn.it -spool test-cw-myproxy.sub”

Is the workflow I am following the right one to make use of MyProxy in HTC?

Do anyone has suggestions on how to handle this expiring proxies+long computation thing other than MyProxy (if MyProxy is not the ideal one)?

Thank you in advance for any reply!

Gabriele Gaetano Fronzé - PhD
gabriele.fronze@xxxxxxxxxx / gfronze@xxxxxxx

INFN, CERN and Elemento Modular Cloud

---