Pilot Job Control

1
Pilot Job Control
Current modus operandi
2
Gatekeeper/Batch Queue
DNIgor
1
GUMS
4
CDFCAF
3
(5)
WN Ambers job runs as DNIgor
DNAmber
SAZ
DNMark
DNBob
WN Marks job runs as DNIgor
DNJoe
...
...
GUMS DN to local UID mapper SAZ site DN
authorization
2
Pilot Job Control
Glexec modus operandi
2
Gatekeeper/Batch Queue
DNIgor
1
GUMS
4
CDFCAF
3
5
7
WN glexec maps job to DNAmber
DNAmber
DNMark
6
DNBob
SAZ
WN glexec maps job to DNMark
DNJoe
...
...
GUMS DN to local UID mapper SAZ site DN
authorization
3
Pilot Job Control

• We recognize that there is no feasible way to
  technically control the execution of pilot jobs -
  it is very easy for an end user to hide the
  execution of Pilot Jobs.
• The only way to control Pilot Jobs is with policy

4
Pilot Job Control
A Pilot Job is defined as a job where a Job
Manager submits a job request to a grid batch
system but the application that is executed on
the Worker Nodes has been created by, and the
input and output data is owned by, another
user. A Pilot Job must correctly map the
executed application and the input and output
data to the actual owner of the
application. Any job that is discovered to be a
Pilot Job which does not correctly perform the
appropriate user mapping using the Site supplied
utility (i.e., glexec) will be terminated
immediately and the DN of the Job Manager will be
placed on the Site Black List until the situation
is rectified.
5
Pilot Job Control

• Some of you know that Im a pilot...

6
Pilot Job Control

• There are two new pilots on the way!