reanahub / reana-auth-rucio

REANA authentication sidecar for Rucio

REANA Authentication Rucio

About

reana-auth-rucio provides a container image for creating the right Rucio configuration for REANA workflow jobs. The container image includes no additional logic or libraries, just the bare minimum to support Rucio. The image is configured to support authentication for the four experiments at CERN's Large Hadron Collider (ALICE, ATLAS, CMS, LHCb), as well as ESCAPE Virtual Organization.

reana-auth-rucio was developed for use in the REANA reusable research data analysis platform.

Usage

You can use reana-auth-rucio as a base image, however it was built to be used as a sidecar container with the single purpose of creating the right Rucio configuration. Once obtained, the configuration files are shared with the main container using common namespaces.

The end users can ask for Rucio support by means of declaring rucio: true. Currently, the container requires VOMS authentication meaning that voms_proxy: true has also to be declared, enabling the reana-auth-vomsproxy sidecar container.

Inside the container Rucio commands can be executed, for example via:

$ rucio whoami

Dependencies

Building the container and successfully obtaining Rucio configuration requires additional files present in this repository:

• files/CERN-bundle.pem downloaded from Rucio GitLab repository;
• files/rucio.cfg.j2 Rucio configuration template.

Changes

Version 1.1.1 (2023-09-11)

• Adds more WLCG certificates to facilitate data access to outside-CERN sites.

Version 1.1.0 (2023-08-22)

• Changes Rucio client version to 1.30.0.
• Changes installation to use fully-qualified container image names to be Podman friendly.
• Fixes EGI trustanchors installation troubles by switching to CERN CA bundles.

Version 1.0.0 (2022-10-13)

• Initial release.

Development

You can build the reana-auth-rucio image by optionally passing the build arguments BASETAG in order to specify the tag of rucio/rucio-clients.

More information

For more information about REANA reusable research data analysis platform, please see its documentation.

reana-auth-rucio's Issues

initial implementation

Make initial implementation of Rucio authentication sidecar (relying on VOMS proxy still) following the reana-auth-vomsproxy repository model.

We shall need updates to:

• reana-auth-rucio
• reana-job-controller
• reana-commons
• reana-workflow-engine-cwl
• reana-workflow-engine-serial
• reana-workflow-engine-snakemake
• reana-workflow-engine-yadage
• docs.reana.io
• reana

docker: upgrade base image and/or Rucio version

Current status

The reana-auth-rucio component is using version 1.30.0 of Rucio, which is based on CC7:

$ docker run -i -t docker.io/rucio/rucio-clients:release-1.30.0 /bin/bash -c 'cat /etc/redhat-release'
CentOS Linux release 7.9.2009 (Core)

This is not ideal due to CC7 being at its end-of-life, see https://linux.web.cern.ch/#cc7-rhel7-have-reached-end-of-life.

Desiderata

It would be good to upgrade the Rucio component to use Alma9 and/or Ubuntu 24.04.

This could be done by (i) either sticking to using the older Rucio version and just changing the base image, or by (ii) upgrading Rucio version at the same time, which will be already based on Alma9:

$ docker run -i -t docker.io/rucio/rucio-clients:latest /bin/bash -c 'cat /etc/redhat-release'
INFO:root:Merged 16 configuration values from /opt/user/rucio.default.cfg
INFO:root:Merged 0 configuration values from ENV
INFO:root:Writing /opt/rucio/etc/rucio.cfg
AlmaLinux release 9.4 (Seafoam Ocelot)

The latter would be preferable, and would require to edit Dockerfile to bring up new system packages for dependencies, to possibly alter Rucio configuration files in files, and to test the Rucio functionality with the new version carefully on a few selected REANA examples.