modify CDF job behavior
see RITM0628588 from Willis
1. For CDF job submission by JobSub client, do not send
Kerberos tickets to worker nodes by DEFAULT.
- CDF now can use Fermilab public dCache scratch for
- CDF is the only group with Kerberos tickets, so we
want to help to eliminate this operational burden.
- Without Kerberos security restrictions, CDF will work
on getting CDF Fermigrid jobs to work reliably at
INFN/CNAF -- this would be a benefit to all of
Fermilab if this Tier-1 site is opened up to
opportunistic Fermigrid use by all.
2. CDF needs a user transition period for the phaseout of
- We request a low impact, interim CDF JobSub option,
like --sendtkt, to specify that tickets
(fifegrid@FNAL.GOV) are made and sent to worker
nodes. (Probably good to have a JobSub server
switch that can disable it for good, post transition.)
- The CDF only --outLocation submission option, and
job segment ticket renewal (kinit -R) features are off
by default unless --sendtkt is requested.
3. Please renew CDF JobSub fifegrid@FNAL.GOV keytabs
- Final renewal, no more after transition period.
- CDF keytabs expired two weeks ago, giving this
Fermigrid job submission failure: 'user authorization
failure for CILogin DN' (Kerberos ticket creation
failure on server). INC000000898600 fixed this for 8
active users. Below is list a for 30 users (including the
8) who want to run jobs in the near future.
agioiosa akuchibh aluca brucken bussey cjclarke
dbabal dbox dfitz11 emichiel feirsteo gbyu gfrancio
harr hseo igv kotwal ljimenez pbartos ptl rlc seiya
sforza sganguly suslov tdiamant velev vellidis willis