Pilot job and VO configuration

[ernst pijper]

Hi,

I am wondering about some aspects of the pilot job and VO configuration.

1) The pilot job runs as user GenericPilotUser. This user must also be a member of the VO for which the job is ran. In the corresponding pilot group, there is a Users option. What exactly is this for? What does it mean if a user is a member of a pilot group?

2) In the VO definition, there is a VOAdmin option. In the manual it says:

"One of the mandatory attributes of the VO is the VOAdmin (administrator of the VO), it must be registered as a DIRAC user(see the example below). If the described VO is a VOMS VO, then it is important to note that the VO administrator should have an administrative role in the VOMS VO, it is necessary to obtain relevant information from the VOMS servers regarding VO users. In this case, the addition of VOMS VO is considered, respectively, there are attributes specific to VOMS."

The explanation is not quite clear to me. If I set this option to a user which is not even a member of the VO, the job still runs fine. So when is this option required? Is it just needed for the VOMS2CSAgent?

Ernst

[Andrei Tsaregorodtsev]

Hi,

1. The Users option in the pilot group lists all the users that in principle can run pilot jobs. But at any moment only one user is entitled to do that.

Being a member of the pilot group gives the user the rights necessary for running pilot jobs, for example, the right to extract user's proxies from

the ProxyManager.

2. The VOAdmin user identity is supposed to be used for operations related to the VO management. For the moment, it is only used by VOMS2CSAgent

indeed. But it can be probably used for other purposes in the future also. It is not used in the job scheduling operations. I must admit that the

documentation phrase is far not clear indeed.

  Cheers,

  Andrei

[ernst pijper]

Hi Andrei, 

Op donderdag 2 december 2021 om 10:51:08 UTC+1 schreef Andrei Tsaregorodtsev:

Hi,

1. The Users option in the pilot group lists all the users that in principle can run pilot jobs. But at any moment only one user is entitled to do that.

Being a member of the pilot group gives the user the rights necessary for running pilot jobs, for example, the right to extract user's proxies from

the ProxyManager.

And the one user that is allowed to run a pilot job is give the the GenericPilotUser, right? 

2. The VOAdmin user identity is supposed to be used for operations related to the VO management. For the moment, it is only used by VOMS2CSAgent

indeed. But it can be probably used for other purposes in the future also. It is not used in the job scheduling operations. I must admit that the

documentation phrase is far not clear indeed.

 

 Ok clear.

Ernst

[Andrei Tsaregorodtsev]

The  GenericPilotUser is the currently chosen "shifter" to run pilot jobs. This user must be the member of the pilot group. Typically, this user should be

physically available in order to intervene in case sites have any problems with the VO pilot jobs. For the sites this is the owner of "normal" grid jobs.

  Cheers,

  Andrei