Main changes in ARC 7 compared to ARC 6

ARC 7 represents the next major release of the Advanced Resource Connector Middleware building upon the technology preview components that were already included in the previous major ARC 6 version released in 2019 and has been developed further during the past years. ARC 7 consolidates the technology developments that took place on the ARC 6 line of the middleware. ARC 7 continues streamlining the ARC CE interfaces and the codebase by implementing intensive functionality and code cleanup. In ARC 7 the REST interface is promoted as the primary job management and information retrieval interface of the ARC CE and token-based authentication and authorization is treated on equal level with X509 proxies. ARC 7, despite being a major release, remains as much backward compatible as possible with ARC 6 CEs. An ARC6 server configuration, modulo the deprecated components is expected to work with ARC 7 release.

Note

The primary interface of ARC 7 CE is now the REST 1.1, all the other older versions of WS interfaces and the legacy gridftp job submission interface are obsoleted. The LDAP-based CE information interface is still available, though marked as legacy. ARC 6 clients can only submit and manage jobs on ARC 7 CE via the REST interface while ARC 7 clients are able to submit and manage jobs on ARC 6 CEs using both the REST interface and the deprecated gridftp jobsubmission interface. For the later, the legacy globus plugin should be installed.

Full list of changes in ARC 7

Server-side configuration changes ARC CE configuration

The server-side configuration has undergone smaller clean up, some attributes got regrouped and some configuration blocks got removed due to oboleted functionality. New attributes were also introduced. No renaming of configuration parameters took place. All the config changes are listed below:

  • obsoleted and removed configuration blocks: [authtokens], [lrms/ssh], [arex/ws/publicinfo], [arex/ws/argus], [arex/jura/archiving], [gridftpd], [gridftpd/jobs], [gridftpd/filedir], [infosys/glue1], [infosys/glue1/site-bdii], [acix-scanner], [acix-index], [userlist:name], [nordugridmap]

  • new configuration block: [infosys/accesscontrol]

  • new configuration parameters: authtokens and authokensgen in [authgroup], tokenscopes and authokenmap in [arex], tlsserverorder in [arex/ws]

  • new or modified parameter values: modified allowed values for lrms type in [lrms], new supported environment variables for the plugin parameter in [authgroup], benchmark in [lrms], copyurl in [arex/data-staging]

  • obsoleted and removed configuration parameters: interactive_contactstring in [infosys/cluster], userlist in [authgroup], use_remote_acix in [arex/data-staging]

Internal restructuring and improvements

  • Major redesign of how A-REX organizes and stores its internal information about jobs in specific files located under the A-REX control directory.

  • Added support for conf.d type ARC configuration: if an arc.conf.d directory exists next to arc.conf file, all files in this directory ending with .conf will be read in alphabetical order and their content merged with the arc.conf file.

  • Added support for using the system CAs instead of traditional IGTF CAs, see the x509_cert_policy option in the [common] block.

REST 1.1 is the primary ARC CE interface

  • REST is used exclusively for both job management and information retrieval. All other previous CE interfaces are deleted or labelled OBSOLETED in ARC 7.

  • The REST interface got extended to support bulk job submission of identical job. The optional instances parameter can be used to request the creation of <number> of identical jobs defined by the same identical job description document in the request body. The arcsub cli also got new options –instances-max and –instances-min to specify those numbers.

  • JWT token delegation is now supported in REST 1.1. The Delegation protocol depends on the delegation type (x509 or jwt) specified with an optional type parameter. If not explicitly specified the default delegation type is x509 for backward compatibility with REST API 1.0.

Token-based authentication and authorisation

  • Token based authentication is now enabled by default together with x509 proxy based authentication. In ARC 7 tokens are treated on equal basis with x509 proxies. As a consequence, the previously available [authtokens] block in arc.conf got obsoleted and removed.

  • Extended support for using token information (scopes) for authorization and identity mapping. Added support for managing VO information via tokens.

  • arcctl comes with a built-in test token issuer that is very useful to testing ARC CE installation with tokens.

Information interfaces and information indices in ARC 7

  • REST is the primary interface to obtain CE and job information. EMIES and all the other previous WS-based information publishing is removed. Server-side LDAP is kept but labelled OBSOLETED.

  • ARCHERY is the only remaining supported information index service in ARC 7

  • For backward compatibility with monitoring systems the LDAP-based server side information publishing is kept in ARC 7 nevertheless this information system technology is now labelled as OBSOLETED and target for removal in an upcoming release.

  • Job states are only published via the REST interface and those are confirming to either the REST states or the nordugrid schema values.

  • The publicinfo xml cluster document is by default available without the need of authentication (as the information is regarded as public). At the same time a new block [infosys/accesscontrol] enables configuration of access to information via the usage of the denyaccess and allowaccess parameters for more control.

Accounting subsystem changes

  • The accounting subsystem in ARC7 is updated to improve operational efficiency.

  • ARC 7 comes with a redesigned database schema for better handling of production use-cases, cleanup, backup, rotation, improved troubleshooting and performance optimization features

  • On upgrade ARC7 will immediately start writing data to the new accounting database without blocking startup and job submission.

  • CE admins can migrate records from the old database to the new one at their convenience with arcctl , minimizing disruption.

  • Republishing with arcctl works with both old and new databases.

  • Project information is now configurable for APEL accounting

  • More consistent handling of benchmark information across various ARC configuration blocks.

  • Token information is now part of the accounting records.

ARC CE LRMS support

  • With ARC 7 it is still required that the computing cluster behind the ARC CE comes with a batch or LRMS system deployed.

  • The fully supported thus recommended LRMS options for ARC 7 are the SLURM and Condor batch systems. Fork as a single node simplistic fall-back solution is also available and fully supported.

  • LRMS integration with further LRMS systems such as Boinc, SGE, PBS/PBSPro/OpenPBS, LSF and Loadleveler (LL) are provided as part of ARC 7 however only on a best effort community basis.

  • In ARC 7 the Batch system modules are distributed in two separate packages, the “supported” and the “contrib”

  • The support for Loadleveler and LSF are labelled as OBSOLETED and removal of these components are expected in an upcoming ARC release.

  • The experimental Python-based LRMS implementetion, including the remote-SSH LRMS backend have been removed from ARC.

Software package changes

  • New package containing the python-based REST client (python3-arcrest)

  • New package for the community supported LRMS systems (arc-arex-lrms-contrib)

ARC client-side components

  • no new development took place in the arc cli commands apart from the removal of the non-supported interfaces and some minor synchronization of cli behaviour and cli documentation.

  • ARC Control Tool (arcctl), the recommended server-side system administration tool to work with various ARC and third-party components, has been under continous upgare to meet all the introduced ARC7 internal and external changes. arcctl offers a convenient tool for ARC site admins by wrapping typical complex operations and unifying ARC CE administration under a single utility.

  • pyarcrest, a python tool to utilize the ARC REST interface has been added to the ARC 7 release boundle. Get it from the python3-arcrest package.

Compatibility with ARC 6 components

  • ARC6 clients can submit jobs to ARC7 CEs via the ARC 7 REST interface. For this one must install the arcrest plugin package for ARC 6

  • ARC7 clients will work only with REST-based ARC6 CEs.

  • Data staging between ARC7 and ARC6 servers should work without any problem.

  • An arc.conf file from an ARC 6 CE should work with an ARC 7 CE modulo the deprecated configuration values and blocks. Validation of the ARC configuration is enforced by A-REX startup scripts. If you have obsoleted configuration blocks or parameters in the arc.conf then A-REX will not start, and you will be pointed to the error.

REMOVED and OBSOLETED components

The following components and functionalities have been removed and are not supported any in ARC7 any longer:

  • Server-side gridftp-based ARC solutions both for job management and data storage

  • Both server and client-side support for EMIES job management interface

  • ARC Cache Index (ACIX), that was a distributed system that maintained a catalog of locations of cached files stored in various A-REX caches.

  • userlists generation and mapping support by nordugridmap utility

  • archiving of the JURA accounting service (got removed already in the 6.8.0 release)

  • GLUE1 and site-BDII support within the LDAP-based components of the ARC information system

  • Remote batch system backend support via SSH

  • Python-based LRMS backend framework (it never progressed beyond technology preview status)

  • Support for ARGUS via AREX/WS component

  • Support for python2

  • LDAP information system support in the ARC7 clients

  • EGIS resource discovery in the ARC 7 clients

  • The following components and functionalities have been kept but labelled as DEPRECATED and target for near-future removal:

  • OBSOLETED: LDAP-based server-side information system with GLUE2 and nordugrid schema rendering

  • OBSOLETED: gridftp protocol for data staging (still available in ARC 7 and provided as a separate plugin package)

  • OBSOLETED: Support for Loadleveler and LSF batch systems