Installing OSG in a VirtualBox Machine

Transcription

1 SPRACE-Brazil December 10, 2008

2 VirtualBox Using SUN xvm VirtualBox version Guest Operational system installed using CentOS-5.2-x86_64-bin-DVD.iso 12 GB image called testserver1 To use only your terminal, using ssh: # set the guest port (port 22 for sshd) VBoxManage setextradata "testserver1"\ "VBoxInternal/Devices/pcnet/0/LUN#0/Config/sshd/GuestPort" 22 # set the host port (the port where the VirtualBox-process listens on behalf of the VM) VBoxManage setextradata "testserver1"\ "VBoxInternal/Devices/pcnet/0/LUN#0/Config/sshd/HostPort" 2222 # set the protocol VBoxManage setextradata "testserver1"\ "VBoxInternal/Devices/pcnet/0/LUN#0/Config/sshd/Protocol" TCP adding a secondary network interface: VBoxManage modifyvm "testserver1" -nic2 intnet VBoxManage modifyvm "testserver1" -intnet2 intnet you can boot and access your virtual machine in text mode with: VBoxVRDP -startvm "testserver1"& ssh -p 2222 root@localhost

3 Network on VirtualBox Some words about networking, what was customized: ~]# more /etc/hosts localhost.localdomain localhost ::1 localhost6.localdomain6 localhost testserver1.sprace.org.br ~]# more /etc/sysconfig/network NETWORKING=yes NETWORKING_IPV6=no HOSTNAME=testserver1.sprace.org.br the secondary network card: ~]# more /etc/sysconfig/network-scripts/ifcfg-eth1 DEVICE=eth1 ONBOOT=yes BOOTPROTO=none NETMASK= IPADDR= GATEWAY= TYPE=Ethernet IPV6INIT=no PEERDNS=yes USERCTL=no

4 Pacman and Condor Pacman: To download and install all VDT components you will need it ~]# cd /opt/ opt]# wget \ [root@testserver1 opt]# tar --no-same-owner -xzvf pacman-3.26.tar.gz [root@testserver1 opt]# cd pacman-3.26 [root@testserver1 pacman-3.26]# source setup.sh Condor: We installed it detached from VDT in order to upgrade it. [root@testserver1 pacman-3.26]# cd /opt [root@testserver1 opt]# mkdir condor [root@testserver1 opt]# cd /tmp/ [root@testserver1 tmp]# tar -xvzf condor linux-x86_64-rhel5-dynamic.tar.gz [root@testserver1 tmp]# cd condor [root@testserver1 condor-7.0.5]# groupadd condor [root@testserver1 condor-7.0.5]# adduser condor -g condor -d /home/condor [root@testserver1 condor-7.0.5]#./condor_configure --install --maybe-daemon-owner \ --make-personal-condor --install-log /opt/condor/post_install --install-dir /opt/condor/

5 Condor Configuration Some work on condor configuration: condor-7.0.5]# vim /opt/condor/etc/condor_config RELEASE_DIR = /opt/condor LOCAL_DIR = $(RELEASE_DIR)/hosts/$(HOSTNAME) LOCAL_CONFIG_FILE = $(LOCAL_DIR)/condor_config.local CONDOR_HOST = FILESYSTEM_DOMAIN = grid COLLECTOR_NAME = GRIDUNESP HOSTALLOW_WRITE = *.sprace.org.br *.grid [root@testserver1 condor-7.0.5]# cd /opt/condor/ [root@testserver1 condor]# mkdir hosts [root@testserver1 condor]# mkdir hosts/ hostname -s [root@testserver1 condor]# mkdir hosts/testserver1/{log,execute,spool} [root@testserver1 condor]# vim hosts/testserver1/condor_config.local NETWORK_INTERFACE= DAEMON_LIST = MASTER, STARTD, SCHEDD, COLLECTOR, NEGOTIATOR [root@testserver1 condor]# chown condor: hosts/testserver1/* To each node repeat the last five steps, but put only the following line in their condor_config.local: NETWORK_INTERFACE= XX where XX is the internal IP address.

6 Condor Initialization Now prepair the initilization service, using this script: condor]# vim /etc/init.d/condor # chkconfig: # description: Condor batch system ### BEGIN INIT INFO # Provides: condor # Required-Start: $network # Required-Stop: # Default-Start: # Default-Stop: # Description: Condor batch system ### END INIT INFO # Determine if we re superuser case id in "uid=0("* ) vdt_is_superuser=y ;; * ) vdt_is_superuser=n ;; esac CONDOR_SBIN=/opt/condor/sbin MASTER=$CONDOR_SBIN/condor_master CONDOR_OFF=$CONDOR_SBIN/condor_off PS="/bin/ps auwx" case $1 in start ) if [ -x $MASTER ]; then echo "Starting up Condor" $MASTER

7 Condor Initialization else echo "$MASTER is not executable. exit 1 fi ;; Skipping Condor startup." stop ) pid= $PS grep $MASTER grep -v grep awk {print $2} if [ -n "$pid" ]; then echo "Shutting down Condor" $CONDOR_OFF -master else echo "Condor not running" fi ;; *) echo "Usage: condor {start stop}" ;; esac and add it in your initialization sequence: [root@testserver1 condor]# chmod a+x /etc/init.d/condor; /sbin/chkconfig --add condor

8 Condor Initialization Our test server is a standalone machine, so it will authenticate by itself using GUMS [3]. We also will install the OSG-CE core packages in the following lines: [root@testserver1 condor]# cd /shared [root@testserver1 shared]# mkdir osg [root@testserver1 shared]# cd /shared/osg [root@testserver1 osg-1.0.0]# export VDTSETUP_CONDOR_LOCATION=/opt/condor/ [root@testserver1 osg-1.0.0]# pacman -get OSG:ce [root@testserver1 osg-1.0.0]#source setup.sh [root@testserver1 osg-1.0.0]#pacman -get OSG:ManagedFork [root@testserver1 osg-1.0.0]# $VDT_LOCATION/vdt/setup/configure_globus_gatekeeper\ --managed-fork n --server y [root@testserver1 osg-1.0.0]#pacman -get OSG:gums our computer element alse will deal with managed fork jobs!

9 Obtain Certificates for our Machines In order to request a certificate you need your.globus in your user directory. Using the new procedure you can request it automaticaly using grid-certadmin [1, 2] (please read here [1] before): [root@testserver1 osg-1.0.0]# su - mdias [mdias@testserver1 mdias]$ mkdir.globus [mdias@testserver1 mdias]$ cd.globus [mdias@testserver1.globus]$ scp shell.ift.unesp.br:/users/mdias/user*.pem. [mdias@testserver1.globus]$ source /share/osg-1.0.0/setup.sh [mdias@testserver1.globus]$ su - mdias [mdias@testserver1 mdias]$ cert-gridadmin -host testserver1.sprace.org.br \ -prefix testserver1 ca doegrids -affiliation osg -vo dosar -show \ - mdias@if.unesp.br [mdias@testserver1 mdias]$ exit [root@testserver1 ~]#mv /home/mdias/testserver1cert.pem /etc/grid-security/hostcert.pem [root@testserver1 ~]#mv /home/mdias/testserver1key.pem /etc/grid-security/hostkey.pem [root@testserver1 ~]#chown root: /etc/grid-security/host* [root@testserver1 ~]#chmod 400 /etc/grid-security/hostkey.pem [root@testserver1 ~]#chmod 444 /etc/grid-security/hostcert.pem [root@testserver1 ~]#mkdir /etc/grid-security/http

10 Obtain Certificates for Services Requesting apache certificate. The procedure is almost the same described to request one for a machine: [mdias@testserver1 ~]$ cert-gridadmin -host testserver1.sprace.org.br -service http\ -prefix testserver1 ca doegrids -affiliation osg -vo dosar -show \ - mdias@ift.unesp.br [mdias@testserver1 ~]$ su [root@testserver1 mdias]# mkdir /etc/grid-security/http [root@testserver1 mdias]# mv testserver1cert.pem /etc/grid-security/http/httpcert.pem [root@testserver1 mdias]# mv testserver1key.pem /etc/grid-security/http/httpkey.pem [root@testserver1 mdias]# chmod 444 /etc/grid-security/http/httpcert.pem [root@testserver1 mdias]# chmod 400 /etc/grid-security/http/httpkey.pem [root@testserver1 mdias]# chown -R daemon.daemon /etc/grid-security/http

11 Install CA-Certificates In OSG we don t have this package installed by default: [root@testserver1 mdias]# cd /shared/osg-1.0.0/ [root@testserver1 osg-1.0.0]# vim $VDT_LOCATION/vdt/etc/vdt-update-certs.conf Uncomment the following line to get the CAs from the OSG cacerts_url = [root@testserver1 osg-1.0.0]#. $VDT_LOCATION/vdt-questions.sh; [root@testserver1 osg-1.0.0]# $VDT_LOCATION/vdt/sbin/vdt-setup-ca-certificates [root@testserver1 osg-1.0.0]# vdt-control --enable vdt-update-certs [root@testserver1 osg-1.0.0]# vdt-control --on vdt-update-certs [root@testserver1 osg-1.0.0]# cd /etc/grid-security/ [root@testserver1 grid-security]# ln -s $VDT_LOCATION/globus/TRUSTED_CA certificates also we create a symbolic link to our certificates.

12 GUMS server configuration GUMS:We are ready to configurate our GUMS server now osg-1.0.0]# $VDT_LOCATION/post-install/mysql start osg-1.0.0]# $VDT_LOCATION/post-install/apache start osg-1.0.0]# $VDT_LOCATION/post-install/tomcat-55 start osg-1.0.0]# $VDT_LOCATION/tomcat/v55/webapps/gums/WEB-INF/scripts/addMySQLAdmin "/DC=org/DC=doegrids/OU=People/CN= " osg-1.0.0]# cd $VDT_LOCATION/tomcat/v55/webapps/gums/WEB-INF/scripts scripts]#./gums-create-config --osg-template The last step will download a template used in OSG. Now, point your browser to Remark: you can use your guest operational sistem to do this task, if you configure it as follows: VBoxManage setextradata "testserver1"\ "VBoxInternal/Devices/pcnet/0/LUN#0/Config/osg/GuestPort" 8443 VBoxManage setextradata "testserver1" \ "VBoxInternal/Devices/pcnet/0/LUN#0/Config/osg/HostPort" 8443 VBoxManage setextradata "testserver1" \ "VBoxInternal/Devices/pcnet/0/LUN#0/Config/osg/Protocol" TCP

13 GUMS server configuration Make sure that your certificate is loaded into your browser: but I have some remarks related to my particular account: 1. In order to my DN be mapped to a local account, it was necessary to edit this file: [root@testserver1 osg-1.0.0]# vim\ $VDT_LOCATION/tomcat/v55/webapps/gums/WEB-INF/config/gums.config and change the VOMS server for CMS to this one: baseurl= 2. CMS use pool accounts. A DN is mapped to a fixed user. So you will need to create them first, in Manage Pool Accounts :

14 GUMS server configuration Go to Update VO Members and click on it: I only created the accounted necessary to my DN be mapped checking it with: [root@testserver1 ~]# $VDT_LOCATION/gums/scripts/gums-host generategridmapfile \ /DC=org/DC=doegrids/OU=Services/CN=testserver1.sprace.org.br grep

15 Looking deep on OSG configuration Post-Install Configuration: Read carefully your $VDT_LOCATION/post-install/README. Lets start to follow it: Globus-Base-WS-Essentials and Globus-Base-WSGRAM-Server: scripts]# cd $VDT_LOCATION osg-1.0.0]#cd /etc/grid-security/ grid-security]# cp hostkey.pem containerkey.pem grid-security]# cp hostcert.pem containercert.pem grid-security]# chown daemon: containerkey.pem containercert.pem grid-security]# su - [root@testserver1 ~]# visudo Runas_Alias GLOBUSUSERS = ALL,!root daemon ALL=(GLOBUSUSERS) \ NOPASSWD: /shared/osg-1.0.0/globus/libexec/globus-gridmap-and-execute \ -g /etc/grid-security/grid-mapfile \ /shared/osg-1.0.0/globus/libexec/globus-job-manager-script.pl * daemon ALL=(GLOBUSUSERS) \ NOPASSWD: /shared/osg-1.0.0/globus/libexec/globus-gridmap-and-execute \ -g /etc/grid-security/grid-mapfile \ /shared/osg-1.0.0/globus/libexec/globus-gram-local-proxy-tool * [root@testserver1 ~]# cd $VDT_LOCATION

16 PRIMA: osg-1.0.0]# cp /shared/osg-1.0.0/post-install/gsi-authz.conf \ /etc/grid-security/. [root@testserver1 osg-1.0.0]# cp /shared/osg-1.0.0/post-install/prima-authz.conf \ /etc/grid-security/. GUMS-Client [root@testserver1 osg-1.0.0]#vdt-control --enable gums-host-cron [root@testserver1 osg-1.0.0]#vdt-control --on gums-host-cron PRIMA-GT4 [root@testserver1 osg-1.0.0]#$vdt_location/vdt/setup/configure_prima_gt4\ --enable --gums-server testserver1.sprace.org.br Condor-cron is used to deal with OSG-RSV probes. [root@testserver1 osg-1.0.0]# vim $VDT_LOCATION/condor-cron/etc/condor_config RELEASE_DIR = /shared/osg-1.0.0/condor-cron CONDOR_HOST = LOCAL_DIR = $(RELEASE_DIR)/local.testserver1 UID_DOMAIN = grid FILESYSTEM_DOMAIN = grid COLLECTOR_NAME = GRIDUNESP HOSTALLOW_WRITE = testserver1.sprace.org.br,*.grid [root@testserver1 osg-1.0.0]#more /etc/passwd grep condor cut -d : -f :501 [root@testserver1 osg-1.0.0]# vim $VDT_LOCATION/condor-cron/local.testserver1/condor_config.local CONDOR_HOST = #UID_DOMAIN = sprace.org.br #FILESYSTEM_DOMAIN = sprace.org.br #COLLECTOR_NAME = Personal Condor at testserver1.sprace.org.br CONDOR_IDS = #LOCK =

17 More Services to configure... For this example, we also comment all security setup section in Condor-cron config file. Monalisa: You have to complete your Monalisa monitoring configuration: osg-1.0.0]# vim $VDT_LOCATION/MonaLisa/Service/VDTFarm/ml.properties MonaLisa.Location=Sao Paulo MonaLisa.Country=Brazil MonaLisa.LAT= MonaLisa.LONG= lia.monitor.group=osg osg-1.0.0]# vim $VDT_LOCATION/MonaLisa/Service/CMD/ml_env JAVA_HOME=/shared/osg-1.0.0/jdk1.5 FARM_NAME=GRIDUNESP osg-1.0.0]# vdt-register-service --name MLD --enable Gratia-Metric-Probe osg-1.0.0]#$vdt_location/vdt/setup/configure_gratia --probe metric \ --site-name GRIDUNESP CEMon [root@testserver1 osg-1.0.0]# $VDT_LOCATION/vdt/setup/configure_cemon\ --consumer --topic OSG_CE

18 OSG directories Directories:We will need to allocate grid data, applications, etc [4]. 1. OSG_GRID : Directory where the worker node client (wn-client) or packages to use the grid are installed 2. OSG_APP : Directory available to install job specific applications and binaries 3. OSG_DATA:Directory available for jobs to store data and to stage data in and out, this directory is shared across the cluster 4. OSG_WN_TMP:Directory available for scratch space for worker nodes. This directory is local to each node. 5. OSG_SITE_READ: Directory available for staging in of files. Must be readable by all worker nodes. 6. OSG_SITE_WRITE: Directory available for staging out of files. Must be writable by all worker nodes.

19 OSG directories So, lets do it! osg-1.0.0]# mkdir /shared/osg_app osg-1.0.0]# mkdir /shared/osg_app/{app,data,read,write} osg-1.0.0]# chmod 1777 /shared/osg_app/* Now, we will retrieve some information from GUMS ( again) in order create our osg-user-vo-map.txt and copy and paste into this file osg-1.0.0]# vim $VDT_LOCATION/monitoring/osg-user-vo-map.txt

20 Configure OSG Attributes OSG Attributes:The major configuration is done in config.ini osg-1.0.0]# cp $VDT_LOCATION/monitoring/simple-config.ini $VDT_LOCATION/monitoring/conf osg-1.0.0]# vim $VDT_LOCATION/monitoring/config.ini localhost = testserver1.sprace.org.br admin_ = mafd@mail.cern.ch osg_location = /share/osg site_name = GRIDUNESP sponsor = osg contact = city = Sao Paulo country = Brazil longitude = latitude = [PBS] enabled = False [Condor] enabled = True home = /opt/condor wsgram = True condor_config = /opt/condor/etc/condor_config [SGE] enabled = False [LSF] enabled = False [FBS] enabled = False

21 Configure OSG Attributes [Managed Fork] enabled = True condor_location = /opt/condor condor_config = /opt/condor/etc/condor_config [Storage] grid_dir = /shared/osg-wn-client app_dir = /shared/osg_app/app data_dir = /shared/osg_app/data worker_node_temp = /scratch/osg site_read = /shared/osg_app/read site_write = /shared/osg_app/write se_available = True default_se = testserver1.sprace.org.br [GIP] batch = condor gsiftp_path = /shared/osg_app/data [RSV] enabled = True rsv_user = mdias enable_ce_probes = True ce_hosts = testserver1.sprace.org.br enable_gridftp_probes = True gridftp_hosts = testserver1.sprace.org.br gridftp_dir = /shared/osg_app/data enable_srm_probes = True srm_hosts = testserver1.sprace.org.br srm_dir = /pnfs/sprace.org.br/data/mdias proxy_file = /tmp/x509up_u500 srm_dir = /pnfs/sprace.org.br/data/mdias [MonaLisa] enabled = True [root@testserver1 osg-1.0.0]# cd monitoring/

22 Configure OSG Attributes Remark: The options srm_hosts = testserver1.sprace.org.br srm_dir = /pnfs/sprace.org.br/data/mdias are not in the original file. Verify and correct errors in your config.ini using: [root@testserver1 monitoring]#./configure-osg.py -v Correct these errors. Running it for real now [root@testserver1 monitoring]# ${VDT_LOCATION}/monitoring/configure-osg.py -c -f config.ini [root@testserver1 monitoring]# cd.. Don t forget to turn off mysql, apache and tomcat... [root@testserver1 osg-1.0.0]# $VDT_LOCATION/post-install/apache stop [root@testserver1 osg-1.0.0]# $VDT_LOCATION/post-install/tomcat-55 stop [root@testserver1 osg-1.0.0]# $VDT_LOCATION/post-install/mysql stop and finish it (or almost...) [root@testserver1 osg-1.0.0]# vdt-control --on --force and perform the crucial test [root@testserver1 osg-1.0.0]# $VDT_LOCATION/verify/site_verify.pl

23 References [1] requesting GridAdmin priv [2] [3] [4] Related Parameters