Changes between Version 18 and Version 19 of FeddConfig
- Timestamp:
- Nov 5, 2009 7:16:24 PM (15 years ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
FeddConfig
v18 v19 54 54 === Access Options === 55 55 56 Access control sections follow the [access] header. These attributes concern the how `fedd` grants access to remote experimenters through their `fedd`. Some of the parameters are directly related to whether access is granted and some are parameters returned to the requester so it can manipulate the resources once granted. 56 57 58 Access control sections follow the [access] header. These sections configure access controllers. Some options are universal and some are specific to the type of controller in use. 59 60 These attributes concern the how `fedd` grants access to remote experimenters through their `fedd`. Some of the parameters are directly related to whether access is granted and some are parameters returned to the requester so it can manipulate the resources once granted. 61 57 62 The following are valid attributes: 63 64 ==== All Controllers ==== 65 66 All controllers understand and respect the following: 58 67 59 68 '''accessdb''':: … … 65 74 what to release and when. Must be specified for access decisions to survive 66 75 fedd failures or node reboots. A file in `/var/db/fedd` is often used. 76 '''access_type''':: 77 The underlying plug-in module to use for access. Currently '''emulab''' and '''dragon''' are understood. We will be adding more choices as well as dynamic choices in the near future. The default is '''emulab''', for backward compatibility. 67 78 '''allow_proxy''':: 68 79 Allow this fedd to act as a proxy for others in making access requests. This 69 80 functionality is in development and ''not'' intended for use yet. 70 '''boss''':: 71 Hostname to report as boss to remote testbeds granted access. A requesting `fedd` uses this to configure internals of the 72 federated experiment. This is just the first component of the name, the '''domain''' option provides the rest. 73 '''cert_file''':: 74 Certificate used to assert identity of the access component. It uses this 81 '''cert_file''':: 82 Certificate used to assert identity of the access controller. It uses this 75 83 certificate when proxying requests. Note that the certificates used in the [allocate] section are used to contact a remote allocation `fedd`. If this field is not present and a '''cert_file''' is present in the [globals] section, the [globals] certificate will be used. 84 '''certdir''':: 85 Local certificates for granting access to sub-experiments. This directory should be writable by fedd and unreadable to all others. 76 86 '''cert_pwd''':: 77 87 Password for the private key in '''cert_file'''. If the [globals] certificate is used, so is the [globals] '''cert_pwd''', if any. 78 88 '''domain''':: 79 89 The trailing (common) parts of the domain name for various hosts. Returned to the requester to allow manipulation of resources. 80 '''eventserver'''::81 Hostname of the machine that forwards events in this testbed. Returned to the requester to allow manipulation of resources.82 '''fileserver'''::83 Hostname of the machine that serves user files in this testbed. Returned to the requester to allow manipulation of resources.84 90 '''log_level''':: 85 91 The level of logging to produce from this component. One of `debug`, `info`, `warning`, `critical`, and `error`. See the [http://www.python.org/doc/current/library/logging.html standard python logging system] for details. … … 96 102 present, no certificate path checking is done. If this field is not present and a '''trusted_certs''' field is present in the [globals] section, the [globals] certificates will be used. 97 103 98 === Allocation Options === 99 100 The [allocation] section controls how Emulab project allocation is carried out on the host where `fedd` is running. If the '''uri''' option is set in the [access] section, the [allocation] section defined the parameters used to communicate with the remote `fedd`. If not, project allocation will occur on this machine and the parameters apply to the manipulation of the local Emulab state to grant access. 104 In addition they understand the following debugging settings: 105 106 '''create_debug''':: 107 A boolean. If '''true''' this access controller will not actually allocate resources, but always report success. The default is '''false''' - carry out real allocations. 108 109 '''leave_tmpfiles''':: 110 A boolean. If '''true''' the controller will not remove temporary files allocated when carrying out operations, notably sub-experiment creation. The default is '''false'''- clean up. 111 112 ==== Emulab Controllers ==== 113 114 Emulab controllers understand and respect the following options, as well as the [allocation] section described below. 115 116 '''boss''':: 117 Hostname to report as boss to remote testbeds granted access. A requesting `fedd` uses this to configure internals of the 118 federated experiment. This is just the first component of the name, the '''domain''' option provides the rest. 119 '''eventserver''':: 120 Hostname of the machine that forwards events in this testbed. Returned to the requester to allow manipulation of resources. 121 '''fileserver''':: 122 Hostname of the machine that serves user files in this testbed. Returned to the requester to allow manipulation of resources. 123 '''ops''':: 124 Hostname of the machine that serves user services in this testbed. Returned to the requester to allow manipulation of resources. 125 '''ssh_privkey_file''':: 126 The public key that this `fedd` will use to access remote Emulab services, if it is a remote access controller. Protect it appropriately. Earlier versions always defined this option in as an experiment control option. That is no longer supported. 127 '''type''':: 128 Emulab access controllers can either run on the local testbed inforastructure (users and boss as described in [FeddDownload#Whatmachinesshouldrunfedd the downloading and installation documentation]) or on another node as a proxy. Choices are '''remote_emulab''' and '''local_emulab'''. Remote access controllers access the testbed using ssh for file transfer and other reasons using the key given in '''ssh_privkey_file'''. 129 130 =====Allocation Options ===== 131 132 The [allocation] section controls how Emulab access controllers allocate projects locally. If the '''uri''' option is set in the [access] section, the [allocation] section defined the parameters used to communicate with the remote `fedd`. If not, project allocation will occur on this machine and the parameters apply to the manipulation of the local Emulab state to grant access. 133 134 We do not discuss the somewhat unusual case of a '''remote_emulab''' access controller that creates and destroys projects on the 135 remote emulab by talking to a '''local_emulab''' access controller running on the remote Emulab. Such a thing works, though. 101 136 102 137 The following options are valid: … … 147 182 Script to attach a new local (Emulab) user to a local (Emulab) project. The `user_to_project.py` script shipped with `fedd` is used for this purpose by default. Specifically, the default value of this option is `/usr/local/bin/user_to_project.py`. 148 183 184 ==== Dragon Access Controllers ==== 185 186 DRAGON access controllers allocate resources using the [https://wiki.internet2.edu/confluence/display/DCNSS/Java+Client+API OSCARS client software] so much of its configuration is concerned with connecting the plug-in to that software. 187 188 DRAGON controllers understand and respect the following settings. 189 190 '''axis2_home''':: 191 OSCARS depends on the [http://ws.apache.org/axis2 axis web services client classes]. Setting this variable to the location of these classes is required. 192 193 '''cli_dir''':: 194 The location of the OSCARS command line installation. 195 196 '''idc''':: 197 The uri of the inderdomain controller to reserve circuits through. 198 149 199 === Experiment Control Options === 150 200 … … 157 207 '''cert_pwd''':: 158 208 Password for the private key in '''cert_file'''. If the [globals] certificate is used, so is the [globals] '''cert_pwd''', if any. 159 '''create_debug'''::160 If this boolean is true, this component will not create the experiment, though it will make access control requests to remote testbeds.161 '''fedkit'''::162 Location of the tar file containing the [FeddAbout#TheFederationKit federation kit] to establish the expriment. There is a version available from the downloading [FeddDownload section].163 209 '''experiment_state''':: 164 210 Name of the file where current experiment state state is saved. This state includes 165 211 the allocations made to support each federated experiment request as well as the information necessary to release those resources. Must be specified for experiment to survive 166 212 fedd failures or node reboots. A file in `/var/db/fedd` is often used. 213 '''fedkit''':: 214 Location of the tar file containing the [FeddAbout#TheFederationKit federation kit] to establish the expriment. There is a version available from the downloading [FeddDownload section]. 215 '''gatewaykit''':: 216 Location of the tar file containing additional software required on the in experiments to support extra services. For [http://seer.isi.deterlab.net SEER]-controlled experiments, a seer tarfile is used. 167 217 '''log_level''':: 168 218 The level of logging to produce from this component. One of `debug`, `info`, `warning`, `critical`, and `error`. See the [http://www.python.org/doc/current/library/logging.html standard python logging system] for details. 169 219 '''mapdb''':: 170 220 Database that controlls the default mapping from testbed name to contact URI. 171 '''ssh_pubkey_file'''::172 The public key that this `fedd` will use to access remote Emulab services. Required.173 '''ssh_privkey_file'''::174 The private key corresponding to the key in '''ssh_pubkey_file'''. This should be accessibel without a password, and properly protected, for example in a local filesystem with appropriate permissions, or with `fedd` running under an ssh agent.175 '''ssh_keytype'''::176 Type of key generated for internal accesses in the experiment. It can be either dsa or rsa, but probably does not need to be changed.177 221 '''splitter_uri''':: 178 222 Contact point for using a remote experiment splitter. Generally this should be set to !http://users.isi.dertelab.net:23235 .
