Fischer, Max

Quast, Günter

Zvada, Marian

Journal of Physics Conference Series

English

Max Fischer

Günter Quast

Marian Zvada

Crossref

Featured "Single Sign-In" interface enabling Grid, Cloud and local resources for HEP

KITopen

Journal of Physics: Conference SeriesOPEN ACCESSFeatured "Single Sign-In" interface enabling Grid,Cloud and local resources for HEPTo cite this article: Max Fischer et al 2014 J. Phys.: Conf. Ser. 513 032033 View the article online for updates and enhancements.Related contentCloud Bursting with GlideinWMS: Meansto satisfy ever increasing computing needsfor Scientific WorkflowsParag Mhashilkar, Anthony Tiradani, BurtHolzman et al.-Using the CMS High Level Trigger as aCloud ResourceDavid Colling, Adam Huffman, AlisonMcCrae et al.-Evolution of the ATLAS distributedcomputing system during the LHC longshutdownS Campana and the Atlas Collaboration-This content was downloaded from IP address 129.13.72.197 on 17/01/2018 at 12:08Featured “Single Sign-In” interface enabling Grid,Cloud and local resources for HEPMax Fischer1,2 , Günter Quast1 and Marian Zvada21 Institut für Experimentelle Kernphysik of the Karlsruher Institut für Technologie,Building 30.23, Wolfgang-Gaede-Str. 1, 76131 Karlsruhe2 Steinbuch Centre for Computing of the Karlsruher Institut für Technologie,Hermann-von-Helmholtz-Platz 1, 76344 Eggenstein-LeopoldshafenE-mail: max.fischer@kit.edu, gunter.quast@cern.ch, marian.zvada@kit.eduAbstract. The CMS collaboration is successfully using glideinWMS for managing gridresources within the WLCG project. The glidein mechanism with HTCondor underneathprovides a clear separation of responsibilities between administrators operating the service andusers utilizing computational resources. German CMS collaborators (dCMS) have exploredmodern capabilities of the glideinWMS aiming at merging national grid resources, institutionalCPU power and cloud resources into the set of pools with common sign-in interface presentedtowards HEP analysis users. The key goals of service development include ease of use, uniformaccess, load balancing and automated selection among different resource technologies. Theapproach integrates experience of dCMS during the development and integration phases as wellas production operations and highly encourages other countries to follow. First experience withthe production system and an outlook towards ongoing development will be presented.1. IntroductionWith the CMS collaboration[1] fully adopting glideinWMS [2] in 2013, most of the LHCcollaborations rely on a pilot-based usage model for WLCG resources. The virtual overlayclusters created by this homogenize the fragmented grid environments to increase usability andimprove efficiency. For each collaboration, its pilot overlay globally performs scheduling andbalancing of resources in line with the needs and goals of the collaboration. The added layerbetween resources and users helps to standardise interfaces to the underlying infrastructures.In contrast to resources governed by collaborations on the international scope, those exclusiveto national usage are highly fragmented. Sign-in mechanisms and credentials vary on a case-by-case basis. Users must manually synchronize data and programs between sites. Individualresources also exhibit highly diverse architectures and environments.To cope with this, the German CMS community (dCMS) has decided to launch a pilot serviceon a national scale. With the service unifying the dCMS resources, users are presented witha single sign-in interface to their common grid, cloud and local resources. This paper brieflydescribes the current setup and scope of this service, the basics of user access as well as theplanned and ongoing expansion.20th International Conference on Computing in High Energy and Nuclear Physics (CHEP2013) IOP PublishingJournal of Physics: Conference Series 513 (2014) 032033 doi:10.1088/1742-6596/513/3/032033Content from this work may be used under the terms of the Creative Commons Attribution 3.0 licence. Any further distributionof this work must maintain attribution to the author(s) and the title of the work, journal citation and DOI.Published under licence by IOP Publishing Ltd 12. glideinWMS for dCMSglideinWMS is a fully featured pilot overlay service based on the HTCondor [3] batch systemand its own pilot implementation called glidein. It creates a dynamically sized computing poolby on-demand deployment of worker node software, the glideins, on grid resources. The CMScollaboration aims at replacing its previous grid access models entirely with glideinWMS by theend of 2013[4]. This has encouraged a joined development of infrastructure service, user toolsand workflows.Motivated by this, dCMS has adopted glideinWMS for its pilot service as well. In the pastyear, an instance has been deployed at the Karlsruhe Institute of Technology (KIT) serving asboth proof of concept and foundation for a lasting service. The resource backend is formed bythe grid share dedicated to German users by the grid sites affiliated to the dCMS members DESYHamburg, KIT and RWTH Aachen. While dCMS pilots identify themselves with a dedicatedDN and role, this has been found not to be required for the core functionality.2.1. SetupThe glideinWMS service consists of four components (see figure 1): Users submit their jobs andreceive output on the User Portal. The Collector schedules jobs to available resources and isthe centre of internal service communication. The Frontend monitors the service load relativeto service capacity. If needed, it orders the Factory to produce more workers by deployment ofglideins to resources.The four components of the service are deployed on three dedicated blade servers integratedin the KIT infrastructure. User Portal and Factory requirements both scale with the serviceload; as such, each is hosted on a physical machine. In contrast, the Collector and Frontend arestatic and undemanding in their needs; each is deployed on a virtual machine, sharing the samephysical machine.The User Portal does not necessarily have to be part of the same administrative domain, noris it required to be unique. A second, off-site portal is under consideration at DESY to allowfor better user support via local administrators and customized access methods.2.2. User AuthenticationPilot overlay clusters shift the burden of user authentication from sites to the service. ThedCMS service handles authentication via the Portals the users sign in to. In turn, this enablesusers to access the entire dCMS pool with a single sign-in (see figure 2).By default, users login via SSH to an institute portal using their institute credentials. In thefuture, this will be expanded to logins via certificate credentials. The underlying HTCondorframework user management can still be employed in addition. This allows e.g. enforcing usagepolicies or dealing with malicious users.In a pilot framework jobs are by default anonymous to resources, presenting only the pilotidentity. To ensure site authority over users, identity must be forwarded from the pilot to thehost. This can simply be the user identity in the pilot pool, provided via a file containing thepilot state, or the result of a certificate based identification via gLExec [5]. The later allowssimple logging of identity or switching job execution to an account associated with the user,similar to the gLite grid job execution.2.3. User InterfacesThe service exposes the low-level interfaces of the underlying pool to users. These encompassthe HTCondor CLI tools, jdl job descriptions and HTCondor ClassAd queries, providing userswith access to the full functionality of a regular HTCondor pool. In fact, the glidein pool isindistinguishable from a standard pool to users.20th International Conference on Computing in High Energy and Nuclear Physics (CHEP2013) IOP PublishingJournal of Physics: Conference Series 513 (2014) 032033 doi:10.1088/1742-6596/513/3/0320332Figure 1. Current setup of the dCMSglideinWMS service: The service consists of thefour nodes hosted at KIT - the User Portal,the Collector, the Frontend and Factory. Theresource backend is formed by glideins usingthe dCMS grid share of the three dCMS gridsites at DESY, KIT and RWTH Aachen.Figure 2. Appearance of the dCMS serviceto users: The service presents itself as a singleHTCondor pool to users. With the sign-into the User Portal, all acquired resources aredirectly available. The use of job managersallows users access with familiar tools, makingexisting grid workflows instantly portable.However, users are highly encouraged to make use of Job Managers for submitting andcontrolling jobs. These tools feature their own configuration and control languages and transformthem to instructions for targeted WMS. This removes the need for users to learn new interfacesfor the service and highly simplifies enforcing job restrictions and meta-data conventions.Specifically, the CMS Remote Analysis Builder (CRAB)[6] and the generic job manager GridControl [7] allow users to instantly switch existing grid workflows to the new service.3. Service Development OutlookThe existing service has proven the feasibility of operating a glideinWMS service with the limitedadministration manpower available on a national scale. For the future, this forms the basis tounify the remaining dCMS resources. In addition to providing raw processing power, users alsoexpect a national service to capture, rival or even extend the advantages of existing nationalcomputing environments.3.1. ExpansionIn order to unify the dCMS computing environment, the service is required to incorporate avariety of different resource types. Aside from the technical and administrative challenge, eachtype must be properly integrated into scheduling and provisioning for efficient balancing andusage.Cloud resources are not part of dCMS resources due to administration overhead of managingand accounting for virtual machines. Yet, it would be highly attractive if properly automatizedin a glidein pool. In fact the glideinWMS framework recently introduced support for cloudresources, deploying virtual machines as worker nodes. This is interesting for resource balancing,combining institutional and commercial clouds to dynamically cope with usage-peaks withoutlong-term investments. In addition, users can be provided with access to custom computingsetups via the standard submission interface. For example, this facilitates legacy provisioningof deprecated software.The core of the dCMS computing infrastructure are batch systems affiliated to the institutes.20th International Conference on Computing in High Energy and Nuclear Physics (CHEP2013) IOP PublishingJournal of Physics: Conference Series 513 (2014) 032033 doi:10.1088/1742-6596/513/3/0320333Most prominently, the National Analysis Facility at DESY provides hundreds of batch slots.The HTCondor based framework BOSCO [8] has proven the feasibility of injecting glideins intoproduction batch systems; implementing a similar functionality directly into glideinWMS is along-term plan for the dCMS service development.While many of the batch resources are not operated by the dCMS community, a number isunder direct, if shared, administration. It is possible to integrate these resources by convertingthem to regular, static HTCondor worker nodes. This allows acquiring them with reducedoverhead and better control than via glideins, establishing a reliable base capacity. A smallportion of institute infrastructure has already been converted to HTCondor nodes and linked tothe dCMS service. So far this has been found to seamlessly integrate with the glidein pool withno additional work required compared to the previous batch system administration.3.2. EvolutionRegarding the desired primary use-case of grid-resources there are two possible, opposeddirections of evolution. The obvious path is the integration of dCMS grid pilots into the CentralCMS pilot service. This is in line with the initial purpose of the dCMS grid share as an addedallowance, not a separate service. The alternative is prioritizing the grid share to process lowI/O, low dependency jobs, keeping the the high-performance resources clear. This requires pilotextensions providing interfaces mimicking the primary job resource environment, so that thesystem has maximum flexibility for resource balancing without explicit adjustments by user.Introducing standardized information and configurations via pilots is attractive in general.Pilots can provide up-to-date information for Job Managers to optimise resource usage by jobs.Tools and utilities can be wrapped to introduce additional functionality such as caching or toquickly remedy middleware bugs. General utilities can be provided, e.g. offering mounts toaccess off-site storage for site-independent job execution.Having access to the volume and versatility of dCMS resources opens the possibility foradvanced scheduling. Nodes may be allocated dynamically, offering a number of usage patterns,e.g. for I/O or multi-core usage with the final decision implicitly performed by the matchmakerbased on queued jobs. Moreover, non-blocking priority schemes for multi-core nodes usingoverbooking with different priorities is attractive for handling usage peaks without disruptingthe base operations. Generally, per-node balancing schemes combining high-performance andlong-running jobs for best utilisation will be a focus to achieve maximum gain with limitedresources.3.3. MonitoringKeeping track of resource capacity and user demands is integral to the workings of glideinWMS.This suggests the possibility to use the service to easily derive a range of monitoring information.The glideins automatically map all used resources: availability, utilisation and service qualitycan be assessed directly. This allows the monitoring of the dCMS resources almost in real-time, allowing for the timely detection of problems and potential bottlenecks. The HappyFacemeta-monitoring framework[9] offers the potential to directly integrate this into standard dCMSmonitoring operations.On the national level, the close affiliation between users and service providers lends itself touser focused monitoring. Key figures such as CPU usage, I/O distribution, job performance etc.can be tracked per user for a wide array of resources and thus workflows. Aside from identifyingmisuse, this information supports users in optimizing their tasks for the dCMS computingenvironment. In addition, meta information validation will be a key focus, assessing the qualityof user provided information such as expected walltime. If proven feasible, matchmaking basedon interpreted meta-data should provide optimized scheduling conditions.20th International Conference on Computing in High Energy and Nuclear Physics (CHEP2013) IOP PublishingJournal of Physics: Conference Series 513 (2014) 032033 doi:10.1088/1742-6596/513/3/03203344. Summary and ConclusionThe dCMS glideinWMS service is well established since the beginning of operation less thana year ago. The service runs stable and with full functionality for the initial phase. Muchadministrative experience both for basic operation as well as future approaches has been gained.Most importantly, the feasibility of operating such a service with minimal manpower has beenproven.With this basis firmly established, there are several paths for the evolution of the service. Firstand foremost, integration of new resource types will enable the complete unification of dCMSresources into one service. Additional features and extensions will help increase usability andcapabilities. Advanced monitoring solutions will provide the means to optimize both resourcequality and user workflows.In the long term, the scope of this project may provide solutions that will help to makededicated grid resources more attractive compared to national resources. Even though our workis far from finished, we hope the example for unifying national resources within a single servicewill inspire other communities.AcknowledgmentsThe authors would like to thank the teams and communities of the HTCondor and glideinWMSprojects for their exceptional work and direct as well as indirect support.References[1] CMS Collaboration 2008 The CMS experiment at the CERN LHC JINST 3 S08004 (doi: 10.1088/1748-0221/3/08/S08004)[2] Sfiligoi I, Bradley D C, Holzman B, Mhashilkar P, Padhi S and Wurthwein F 2009 The Pilot Way to GridResources Using glideinWMS 2009 WRI World Congress on Computer Science and Information Engineering2 428–32 (doi:10.1109/CSIE.2009.950)[3] Thain D, Tannenbaum T and Livny M 2005 Distributed computing in practice: the Condor experienceConcurrency Computat.: Pract. Exper. 17 323–56 (doi: 10.1002/cpe.938)[4] Bradley D, Gutsche O, Hahn K, Holzman B, Padhi S, Pi H, Spiga D, Sfiligoi I, Vaandering E, Würthwein Fand the Cms Offline and Computing Projects 2010 Use of glide-ins in CMS for production and analysis J.Phys.: Conf. Series 219 072013 (doi:10.1088/1742-6596/219/7/072013)[5] Groep D, Koeroo O, Venekamp G 2009 gLExec: gluing grid computing to the Unix world J. Phys.: Conf.Series 119 062032[6] Cinquilli M, Fanfani A, Fanzago F, Farina F, Kavka C, Lacaprara S, Miccio V, Spiga D and Vaandering E2009 CRAB: a CMS application for distributed Analysis Nuclear Science, IEEE Transactions on Volume56, Issue 5, Part 2, Oct. 2009 2850 - 8[7] The Grid-Control project homepage URL https://ekptrac.physik.uni-karlsruhe.de/trac/grid-control/[8] Weitzel D, Fraser D, Bockelman B and Swanson D 2012 Campus grids: bringing additional computationalresources to HEP researchers J. Phys.: Conf. Series 396 032116 (doi:10.1088/1742-6596/396/3/032116)[9] Mauch V, Ay C, Birkholz S, Büge V, Burgmeier A, Meyer J, Nowak F, Quadt A, Quast G, Sauerland P,Scheurer A, Schleper P, Stadie H, Tsigenov O and Zvada M 2011 The HappyFace Project J. Phys.: Conf.Series 331 082011 (doi:10.1088/1742-6596/331/8/082011)20th International Conference on Computing in High Energy and Nuclear Physics (CHEP2013) IOP PublishingJournal of Physics: Conference Series 513 (2014) 032033 doi:10.1088/1742-6596/513/3/0320335

Featured "Single Sign-in" interface enabling Grid, cloud and local resources for HEP

https://publikationen.bibliothek.kit.edu/1000042239/6000712

Featured "Single Sign-in" interface enabling Grid, cloud and local resources for HEP

Abstract

Similar works

Full text

Available Versions

Crossref

KITopen