Dynamic integration of distributed, Cloud-based HPC and HTC resources using JSON Web Tokens and the INDIGO IAM Service

¹ INFN Sezione di Perugia, Via Alessandro Pascoli 23c, 06123 Perugia (ITALY)
² INFN-CNAF, Viale Carlo Berti Pichat, 6/2, 40127 Bologna (ITALY)
³ Università di Parma, Parco Area delle Scienze 7/A, 4214 Parma (ITALY)
⁴ INFN Gruppo collegato di Parma, Parco Area delle Scienze 7/A, 42124 Parma (ITALY)

^* Corresponding author: spiga@infn.it
^** Corresponding author: stefano.dalpra@cnaf.infn.it

Published online: 16 November 2020

Abstract

In the past couple of years, we have been actively developing the Dynamic On-Demand Analysis Service (DODAS) as an enabling technology to deploy container-based clusters over hybrid, private or public, Cloud infrastructures with almost zero effort. DODAS is particularly suitable for harvesting opportunistic computing resources; this is why several scientific communities already integrated their computing use cases into DODAS-instantiated clusters, automating the instantiation, management and federation of HTCondor batch systems. The increasing demand, availability and utilization of HPC resources by and for multidisciplinary user communities, often mandates the possibility to transparently integrate, manage and mix HTC and HPC resources. In this paper, we discuss our experience extending and using DODAS to connect HPC and HTC resources in the context of a distributed Italian regional infrastructure involving multiple sites and communities. In this use case, DODAS automatically generates HTCondor batch system on-demand. Moreover it dynamically and transparently federates sites that may also include HPC resources managed by SLURM; DODAS allows user workloads to make opportunistic and automated use of both HPC and HTC resources, thus effectively maximizing and optimizing resource utilization. We also report on our experience of using and federating HTCondor batch systems exploiting the JSON Web Token capabilities introduced in recent HTCondor versions, replacing the traditional X509 certificates in the whole chain of workload authorization. In this respect we also report on how we integrated HTCondor using OAuth with the INDIGO IAM service.