The EPIKH Project (Exchange Programme to advance e-Infrastructure Know-How) Overveiw of the gLite middleware Yaodong Cheng IHEP, CAS Asia EPIKH School for Grid Site Administrators Beijing,

EPIKH School for Grid Site Administrators, Beijing, /33 Outline Introduction gLite main components Site architecture and deployment

EPIKH School for Grid Site Administrators, Beijing, /33 gLite Grid gLite Grid System aims to: Integrate Virtualize Manage RESOURCEs and SERVICEs across different VOs The gLite middleware is the set of software packages able to do this

EPIKH School for Grid Site Administrators, Beijing, /33 Definitions Computational Resource –The machine where users can execute programs (called jobs), can store or access to stored data in a transparent fashion; no matter where they are located. Job –An executable or a batch script that the users want to execute on the Worker Node Job Submission –Is the action when the best available computational resource is assigned by the system to the user in order to execute the job.

EPIKH School for Grid Site Administrators, Beijing, /33 Overview The user joins to a VO INTERNET

EPIKH School for Grid Site Administrators, Beijing, /33 The user joins to a VO Each VO shares grid resources to other VOs accordingly to several policies. INTERNET Overview

EPIKH School for Grid Site Administrators, Beijing, /33 The user joins to a VO Each VO shares grid resources to other Vos accordingly to several policies. The Grid middleware allow to use and share: –“Computing Elements (CE)” –“Storage Element (SE)” INTERNET Overview

EPIKH School for Grid Site Administrators, Beijing, /33 Overview The users join to a VO Each VO shares grid resources to other Vos accordingly to several policies. The Grid middleware allow to use and share: –“Computing Elements (CE)” –“Storage Element (SE)” Plus Additional services to empower the capabilities of the Grid INTERNET

EPIKH School for Grid Site Administrators, Beijing, /33 The users join to a VO Each VO shares grid resources to other Vos accordingly to several policies. The Grid middleware allow to use and share: –“Computing Elements (CE)” –“Storage Element (SE)” Plus Additional servicees to empower the capabilities of the Grid Result: COLLABORATION INTERNET Overview

EPIKH School for Grid Site Administrators, Beijing, /33 Grid Requirements Heterogeneous (OSes, Devs, Apps.) VO Resource Sharing (Management, Security and Accounting) Resource Utilisation (Reservation, Metering, Monitoring and Logging) Job Execution (VO access, QoS, SLA) Data Services (Integration, Provisioning, Cataloguing, Metadata) Security (Authentication, Authorisation and Auditing) Administrative Costs (Provisioning, Deployment and Configuration) Scalability Availability (Disaster Recovery, Fault Management) Specific Requirements: (EGEE: HEP, BioMed)

EPIKH School for Grid Site Administrators, Beijing, /33 gLite evolution GTK2Web services based gLite-2gLite-1LCG-2LCG-1gLite-3 GTK4 gLite - Lightweight Middleware for Grid Computing –

EPIKH School for Grid Site Administrators, Beijing, /33 gLite Main components services User Interface (UI) User Interface (UI):The place where users logon to the Grid Computing Element (CE) Computing Element (CE): A batch queue on a site’s computers where the user’s job is executed Storage Element (SE) Storage Element (SE): provides (large-scale) storage for files Resource Broker (RB/WMS) Resource Broker (RB/WMS): Matches the user requirements with the available resources on the Grid Information System Information System: Characteristics and status of CE and SE (Uses “GLUE schema”)

EPIKH School for Grid Site Administrators, Beijing, /33 The User Interface (UI) is the user entry point normally considered the user workstation. It is normally considered as a WMS component. The Resource Broker (RB) or Workload Management System (WMS) its a set of services having the responsability to find the best available computing element where submit user’ jobs in a transparent fashion The Logging and bookkeeping service (LB), keep track of user job execution in terms of statuses: Ready, Scheduled, Waiting, Running, Done The Computing element (CE) is the computational resource, the entry point to a cluster or PCs handled by a job queue management system; in particular: TORQUE, PBS, LSF, CONDOR The Worker Nodes are the machines where jobs are really executed and managed by the CE’ queue management system Components

EPIKH School for Grid Site Administrators, Beijing, /33 The Information System and Monitoring (IS and MON now deprecated), maintain data related to available grid resources and their health statuses. The Virtual Organization Management service (VOMS), is the way gLite improves the management of authentication and authorization to the Grid resources. The VOMS allows to their own members to define different access rights to VO’ resources The Storage element (SE) and the File catalogue (LFC), allow to manage Grid files and offer a mechanism to locate them easily for users and jobs. Components

EPIKH School for Grid Site Administrators, Beijing, /33 Components interaction File Replica Catalogue Logging & Book-keeping ResourceBroker StorageResource ComputingResource = batch queue InformationService Job Status Datasets info Author. &Authen. Job Submit Event Job Query Job Status Input files Input Output Output files Publish Resource info User/Grid interface

EPIKH School for Grid Site Administrators, Beijing, /33 Job life cycle

EPIKH School for Grid Site Administrators, Beijing, /33 gLite services gLite services can be grouped in 5 main high level set of services Grid Access Security Information system & Monitoring Job Workload Management System Data Management

EPIKH School for Grid Site Administrators, Beijing, /33 gLite – Grid access Two possibilities: APIs or CLI Built on top of them there exist GridPortals and GUIs

EPIKH School for Grid Site Administrators, Beijing, /33 gLite Security User authentication is based on X.509 (PKI)‏ Authorized Certification Authorities (CA) can generate user and service certificates who identify univocally people or Grid services in the whole Grid Each Grid service may support or not certificates coming from different CAs To reduce the vulnerabilities the identification of users in to the grid is done through the use of proxy certificates. Proxyes are singed ‘copies’ of the original user certificate, having a limited lifetime. The use of Proxy certificates allows the following: Delegation: Any grid service can operates on the user behalf making signed copies of the original proxy. (Single Sign On) Add additional info (Add VO specific information provided by VOMS)‏ Store a long term proxy on a secure server (MyProxy) Renewal (A Proxy close to the expiration time can be automatically renewed)‏

EPIKH School for Grid Site Administrators, Beijing, /33 gLite Security: AutH/AhtZ Authentication –The user receive a certificate from a CA (PKI third party) –He connects to the UI via SSH –He Creates the proxy (single sign on) – All grid services will use this proxy to identify the user. Authorization –The user has to subscribe to a VO (VOMS) –The VO establishes the user rights –In any Grid service it will be verified if the user belongs to the VO and assigns the proper access rights to the user –A special configuration file named the “gridmapfile”, maintains the correspondency between grid users and resource users (unix pool accounts)

EPIKH School for Grid Site Administrators, Beijing, /33 Virtual Organization Membership Service –Manages many Virtual Organizations (VOs). –Multiple user roles can be defined inside each VO  Extends the X509 schema  Extensions are Digitally Signed –Service maintenance provided by a web front-end –Support MyProxy (stored proxies) –Allow the access rights by VO or by Role –Each Grid site associates to each VO member or role a a local authentication (unix pool accounts)‏.  Allows to implement fine grained security policies to grid resources VOMS

EPIKH School for Grid Site Administrators, Beijing, /33 MyProxy –Stores a long term proxy certificates to allow the automatic proxy renewal mechanism –Allow to execute jobs requesting a computation time larger that the normal proxy liferime (normally 12 hrs)  The WMS is the responsable of the proxy renewal  Users should not use long lived proxy directly –Allow the user to access grid resources without carrying out the public and private keys.  Proxy Delegation MyProxy

EPIKH School for Grid Site Administrators, Beijing, /33 Berkeley Database Information Index (BDII) The information hierarchically stored via tree modeling (The LDAP implementation of GLUE) GRISStores information at resource level Site BDII/GIIS (deprecated) Stores information at site level BDIIStores information at VO level VO Level Site Level Resource Level Information Systema and Monitoring

EPIKH School for Grid Site Administrators, Beijing, /33 WMS set of middleware components responsible of distribution and management of jobs across Grid resources. Two core components of WMS WM : accepts and satisfy requests for job management. (Matchmaking) is the process of assigning the best available resource. Logging & Bookeeping : keeps track of job execution in term of events: (Submitted, Running, Done,...) Workload Management

EPIKH School for Grid Site Administrators, Beijing, /33 Service that represents the computing resource that is responsible of to manage the queue of jobs to execute The CE may be used by a Generic Client: an end-user interacting directly with the Computing Element, or by the Workload Manager, which submits a given job to an appropriate CE found by the matchmaking process. Two job submission models : PUSH (Eager Scheduling) (jobs pushed to CE), PULL (Lazy Scheduling) (jobs coming from WMS when CE has free slots) Computing Element

EPIKH School for Grid Site Administrators, Beijing, /33 CEAComputing Element Acceptance JCJob Controller MONMonitoring LRMSLocal Resource Management System Computing Element: Architecture

EPIKH School for Grid Site Administrators, Beijing, /33 SE Services are at least: Storage back-end (Drivers and Hardware) Storage Resource Manager (SRM) Interface ( Interface to manage the specific storage solution : dpm, rfio, …) Transfer service ( Protocols: GridFTP ( gsiftp ), glubus-url-copy, …) Native POSIX like file I/O API (GFAL) Auxiliary Accounting and Logging services ( accounting: SAGE) Data are stored on Disk Pool Servers or Mass Storage Systems Storage Element

EPIKH School for Grid Site Administrators, Beijing, /33 OS like file access metaphor. LFN (Logical file name) GUID (Grid unique identifier) SimLinks SURL (Site URL) TURL (Transfer URL) LFC File Catalog

EPIKH School for Grid Site Administrators, Beijing, /33 AMGA – Arda Metadata Grid Application Metadata is data about data On the Grid: information about files  Describe files  Locate files based on their contents through queries But also makes DB access a simple task on the Grid  Many Grid applications need structured data  Many applications require only simple schemas  Can be modelled as metadata  Main advantage: better integration with the Grid environment  Metadata Service is a Grid component  Grid security  Hide DB heterogeneity Metadata

EPIKH School for Grid Site Administrators, Beijing, /33 Deployment Considerations Basic Site Architecture –User Interface (UI): User login environment –Storage Element (SE): Storage resource Services –Computing Element (CE): Gateway to computing resources  Small site will also install Site BDII Batch system manager Shared file system (NFS, Lustre…) for VO software –Worker Node (WN): job execution machine –MON: R-GMA server for accounting UI MON SE Switch CE Shared File system WN

EPIKH School for Grid Site Administrators, Beijing, /33 Deployment considerations Central services –BDII: Top Level information system service  Available regionally –Resource Broker (RB): job management  RB or WMS –VO services  LFC: LCG file catalogue Maps VO’s logical file names to physical file names  VOMS: VO membership service Manages list of VO Members UI MON SE Switch CE Shared File system WN Central services BDII RB VO services LFC VOMS

EPIKH School for Grid Site Administrators, Beijing, /33 Network consideration Grid Services –Public IP required by each grid service –Forward and reverse DNS configuration Worker node –Public IP for parallel stream file transfer –Private IP is possible  Single stream transfer for WNs to remote SE Storage Elements –Bandwidth to and from worker Nodes –Bandwidth to WAN Network Firewall requirements –

EPIKH School for Grid Site Administrators, Beijing, /33 Questions …