Skip to content

Commit 84569c0

Browse files
brianhlinbrianhlin
committed
Copy in osg-ce-condor image contents (SOFTWARE-4300)
1 parent afe054f commit 84569c0

File tree

8 files changed

+193
-0
lines changed

8 files changed

+193
-0
lines changed

‎osg-ce-condor/Dockerfile‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Specify the opensciencegrid/compute-entrypoint image tag
2+
ARG BASE_YUM_REPO=release
3+
4+
FROM opensciencegrid/compute-entrypoint:$BASE_YUM_REPO
5+
6+
ARG BASE_YUM_REPO=release
7+
8+
LABEL maintainer "OSG Software <[email protected]>"
9+
10+
RUN if [[ $BASE_YUM_REPO = release ]]; then \
11+
yumrepo=osg-upcoming; else \
12+
yumrepo=osg-upcoming-$BASE_YUM_REPO; fi && \
13+
yum install -y --enablerepo=$yumrepo \
14+
osg-ce-condor && \
15+
yum clean all && \
16+
rm -rf /var/cache/yum/
17+
18+
COPY etc/osg/image-config.d/* /etc/osg/image-config.d/
19+
COPY etc/condor/config.d/* /etc/condor/config.d/
20+
COPY usr/local/bin/* /usr/local/bin/
21+
COPY etc/supervisord.d/* /etc/supervisord.d/

‎osg-ce-condor/etc/condor/config.d/01-misc.conf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Copied from https://github.com/htcondor/htcondor
2+
3+
# Can't tune the kernel in a container
4+
ENABLE_KERNEL_TUNING=False

‎osg-ce-condor/etc/condor/config.d/01-security.conf‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Copied from https://github.com/htcondor/htcondor
2+
3+
# Require authentication and integrity checking by default.
4+
use SECURITY : With_Authentication
5+
6+
# Host-based security is fine in a container environment, especially if
7+
# we're also using a pool password or a token.
8+
use SECURITY : Host_Based
9+
# We also want root to be able to do reconfigs, restarts, etc.
10+
ALLOW_ADMINISTRATOR = root@$(FULL_HOSTNAME) condor@$(FULL_HOSTNAME) $(ALLOW_ADMINISTRATOR)
11+
12+
# TOKEN-based auth is the preferred method starting with the HTCondor
13+
# 8.9 series.
14+
if version >= 8.9.7
15+
SEC_DEFAULT_AUTHENTICATION_METHODS = FS, IDTOKENS
16+
else
17+
SEC_DEFAULT_AUTHENTICATION_METHODS = FS, TOKEN
18+
endif
19+
20+
if $(USE_POOL_PASSWORD:no)
21+
SEC_DEFAULT_AUTHENTICATION_METHODS = $(SEC_DEFAULT_AUTHENTICATION_METHODS), PASSWORD
22+
23+
ALLOW_ADVERTISE_STARTD = condor_pool@*/* $(ALLOW_ADVERTISE_STARTD)
24+
ALLOW_ADVERTISE_SCHEDD = condor_pool@*/* $(ALLOW_ADVERTISE_SCHEDD)
25+
endif
26+
27+
# Allow public reads; in this case, no need for authentication.
28+
ALLOW_READ = *
29+
SEC_READ_AUTHENTICATION = OPTIONAL
30+
31+
ALLOW_ADVERTISE_MASTER = \
32+
$(ALLOW_ADVERTISE_MASTER) \
33+
$(ALLOW_WRITE_COLLECTOR) \
34+
[email protected]
35+
36+
ALLOW_ADVERTISE_STARTD = \
37+
$(ALLOW_ADVERTISE_STARTD) \
38+
$(ALLOW_WRITE_COLLECTOR) \
39+
[email protected]
40+
41+
ALLOW_ADVERTISE_SCHEDD = \
42+
$(ALLOW_ADVERTISE_STARTD) \
43+
$(ALLOW_WRITE_COLLECTOR) \
44+
[email protected]

‎osg-ce-condor/etc/condor/config.d/50-container.conf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
DAEMON_LIST = MASTER, SCHEDD
2+
3+
# Tell clients to contact the local schedd on the hostname used to
4+
# advertise to other daemons
5+
TCP_FORWARDING_HOST = $(NETWORK_HOSTNAME)
6+
7+
# Force container daemons to talk over the container IP
8+
PRIVATE_NETWORK_NAME = $(UTSNAME_NODENAME)
9+
PRIVATE_NETWORK_INTERFACE = $(IP_ADDRESS)

‎osg-ce-condor/etc/osg/image-config.d/25-setup-condor-submit.sh‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
#!/bin/bash
2+
# Adapted from https://github.com/htcondor/htcondor
3+
4+
set -xe
5+
6+
prog=${0##*/}
7+
8+
fail () {
9+
echo "$prog:" "$@" >&2
10+
exit 1
11+
}
12+
13+
add_values_to () {
14+
config=$1
15+
shift
16+
printf "%s=%s\n" >> "/etc/condor/config.d/$config" "$@"
17+
}
18+
19+
# Create a config file from the environment.
20+
# The config file needs to be on disk instead of referencing the env
21+
# at run time so condor_config_val can work.
22+
echo "# This file was created by $prog" > /etc/condor/config.d/01-env.conf
23+
add_values_to 01-env.conf \
24+
CONDOR_HOST "${CONDOR_SERVICE_HOST:-${CONDOR_HOST:-\$(FULL_HOSTNAME)}}" \
25+
NUM_CPUS "${NUM_CPUS:-1}" \
26+
MEMORY "${MEMORY:-1024}" \
27+
RESERVED_DISK "${RESERVED_DISK:-1024}" \
28+
USE_POOL_PASSWORD "${USE_POOL_PASSWORD:-no}"
29+
30+
31+
bash -x "/usr/local/bin/update-secrets" || fail "Failed to update secrets"
32+
bash -x "/usr/local/bin/update-config" || fail "Failed to update config"
33+
34+
35+
# Bug workaround: daemons will die if they can't raise the number of FD's;
36+
# cap the request if we can't raise it.
37+
hard_max=$(ulimit -Hn)
38+
39+
rm -f /etc/condor/config.d/01-fdfix.conf
40+
# Try to raise the hard limit ourselves. If we can't raise it, lower
41+
# the limits in the condor config to the maximum allowable.
42+
for attr in COLLECTOR_MAX_FILE_DESCRIPTORS \
43+
SHARED_PORT_MAX_FILE_DESCRIPTORS \
44+
SCHEDD_MAX_FILE_DESCRIPTORS \
45+
MAX_FILE_DESCRIPTORS; do
46+
config_max=$(condor_config_val -evaluate $attr ||: )
47+
if [[ $config_max =~ ^[0-9]+$ && $config_max -gt $hard_max ]]; then
48+
if ! ulimit -Hn "$config_max" &>/dev/null; then
49+
add_values_to 01-fdfix.conf "$attr" "$hard_max"
50+
fi
51+
ulimit -Hn "$hard_max"
52+
fi
53+
done
54+
[[ -s /etc/condor/config.d/01-fdfix.conf ]] && \
55+
echo "# This file was created by $prog" >> /etc/condor/config.d/01-fdfix.conf
56+
57+
chown -R condor:condor /var/log/condor /var/lib/condor/spool
58+
59+
set +xe

‎osg-ce-condor/etc/supervisord.d/10-htcondor.conf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[program:condor_master]
2+
user = root
3+
command = /usr/sbin/condor_master -f
4+
autorestart=true
5+
startsecs=20

‎osg-ce-condor/usr/local/bin/update-config‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/bash
2+
# Copied from https://github.com/htcondor/htcondor
3+
4+
# Copy extra configs from `/root/config` if any.
5+
if [[ -d /root/config ]]; then
6+
cp /root/config/*.conf /etc/condor/config.d/
7+
fi
8+
9+
if pgrep condor_master &>/dev/null; then
10+
condor_reconfig
11+
fi
12+
13+
# vim:et:sw=4:sts=4:ts=8

‎osg-ce-condor/usr/local/bin/update-secrets‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/bin/bash
2+
# Copied from https://github.com/htcondor/htcondor
3+
4+
prog=${0##*/}
5+
6+
fail () {
7+
echo "$prog:" "$@" >&2
8+
exit 1
9+
}
10+
11+
12+
# Pool password; used for PASSWORD auth or for the collector to generate tokens from.
13+
if [[ -f /root/secrets/pool_password ]]; then
14+
umask 077
15+
install -o root -g root -m 0600 -D /root/secrets/pool_password /etc/condor/passwords.d/POOL ||\
16+
fail "/root/secrets/pool_password found but unable to copy"
17+
umask 022
18+
(
19+
cd /etc/condor/tokens.d
20+
condor_config_val DAEMON_LIST | grep -q SCHEDD && (
21+
condor_token_create -auth ADVERTISE_MASTER -auth ADVERTISE_SCHEDD -auth READ -identity [email protected] > dockersubmit
22+
)
23+
condor_config_val DAEMON_LIST | grep -q STARTD && (
24+
condor_token_create -auth ADVERTISE_MASTER -auth ADVERTISE_STARTD -auth READ -identity [email protected] > dockerworker
25+
)
26+
)
27+
fi
28+
29+
# A token.
30+
if [[ -f /root/secrets/token ]]; then
31+
umask 077
32+
install -o condor -g condor -m 0600 -D /root/secrets/token /etc/condor/tokens.d/token ||\
33+
fail "/root/secrets/token found but unable to copy"
34+
umask 022
35+
fi
36+
37+
38+
# vim:et:sw=4:sts=4:ts=8

0 commit comments

Comments
 (0)