Choose timezone
Your profile timezone:
HEPiX Virtualisation Working Group Meeting
→
Europe/Zurich
Phone conference
Phone conference
Description
<sl>
Dial +41227676000 and enter access code 0186715 followed by #
Key ##1 to mute/unmute your phone
</sl>
HEPiX Virtulisation WG meeting minutes 2010-04-12
Present (in no particular order):
Tony Cass, CERN
Romain Wartel, CERN
Ulrich Schwickerath, CERN
Martin Bly, RAL
David Kelsey, RAL
Keith Chadwick, FNAL
Sander Klous, NIKEF
Thomas Finnern, DESY
Owen Synge, DESY
Jie Tao, KIT
Ian Gable, University of Victoria
Michel Jouvin, GRIF
Andrea Chierici, INFN Bologna
The discussion was fruitful today, but, I think most would agree, diffucult to capture. Therefore I've done a limited set of notes with some emphasis on things that I believe to be the consensus of the group. I urge anyone who feel something was missed here to alert me.
1. Previous Minutes
- There were no comments on the previous meeting minutes.
2. Use cases & Image generation workflow
- Dave reviewed the discussion from the JSPG meeting.
- Dave went over the three models as discussed in his email to the list April 10, 2010. The working group is concerned only with Models 1 and 2.
- The discussion then began to focus on how images will receive workloads. The discussion was lengthy and many people contributed.
- There were two basic ways discussed to receive workloads, connecting to the site batch system or pilot job frameworks.
- Sander Klous commented that at NIKEF VMs would only be allowed to receive jobs from pilot job frameworks and not by connecting to the site batch system.
- Tony commented that the VM images should not be placed in a more restrictive network environment then a regular worker node.
- The discussion came back to avoiding entirely defining how the workload is received by the image.
Consensus:
A) Images should not be pre-configured to obtain a workload. How the image obtains a workload is a contextualization option left to the site at which the image is instantiated.
B) Instantiated images should not be any more constrained, notably in terms of network access, than a normal worker node at the site at which the image is instantiated.
3. Discussion of point D from Dave's email of April 10.
- There should be no root access by users or VO's to instantiated image.
4. Endorsing of images
- Dave has received input from multiple sources: Thomas Finnern, Sander Klous and Owen Synge.
- Dave commented that there was two types of input to image generation: operating system software, and user software (VO software).
- Dave asked if we require separate endorsements for each of these components or if we can have just one endorser?
- Tony commented that he felt that endorsement from VO was not required much the same way that we don't require a digital signature endorsement from VOs now.
- Sander commented that he felt endorsement from a VO person was a simple way to accomplish listing which images we good from a VO perspective.
- Martin was then used extensively as an example image endorser to explore various scenarios.
- To wrap up the discussion Dave Kelsey is asked to produce a revised version of the image generation policy document that includes two different versions for the clause(s) concerning image endorsement, reflecting the two options considered as relevant during the discussion. The first version of the clause(s) should require a single endorser of the image (assumed, or explicitly stated, to be a worker node manager at the generating site who is considered to be responsible for the security of the base operating system portion of the image) with a requirement for the endorser to identify providers of additional software (notably VO software libraries). The second version of the clause(s) should require explicit endorsement by contributor(s) of all additional software in addition to endorsement from the person responsible for the base operating system portion of the image. The second version of the relevant clause(s) must allow for the possibility that a single person could endorse multiple components of the overall image. (Thanks to Tony for the text of this bullet point.)
5. Agenda for the Face to Face
- Settle on the policy document as far we can.
- Begin the discussion on image distribution mechanisms.
6. Any other business.
- Tony will give a brief interim status report to all of HEPiX in Lisbon
There are minutes attached to this event.
Show them.