Skip to content

SiteDirector._setCredentials should renew the proxy only if below the queue CPUTime #8481

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fstagni wants to merge 2 commits into
base: integration
Choose a base branch
from
+9 −2
Open

SiteDirector._setCredentials should renew the proxy only if below the queue CPUTime #8481

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e012863
fix: _setCredentials should renew the proxy only if below the queueCP…
fstagni Mar 12, 2026
7b85a48
fix: check the validity of the generated pilot proxy
fstagni Mar 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions src/DIRAC/WorkloadManagementSystem/Agent/SiteDirector.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -315,8 +315,7 @@ def _submitPilotsPerQueue(self, queueName: str):
ce = self.queueDict[queueName]["CE"]

# Set credentials
cpuTime = queueCPUTime + 86400
result = self._setCredentials(ce, cpuTime)
result = self._setCredentials(ce, queueCPUTime)
if not result["OK"]:
self.log.error("Failed to set credentials:", result["Message"])
return result
Expand Down Expand Up @@ -924,11 +923,19 @@ def _setCredentials(self, ce: ComputingElement, proxyMinimumRequiredValidity: in

# Generate a new proxy if needed
if getNewProxy:
proxyMinimumRequiredValidity = proxyMinimumRequiredValidity + 86400
Copy link
Contributor

@aldbr aldbr Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about having a fixed proxyDuration of 86400 seconds (should it be configurable in the CS?).
We always tries to generate a proxy lasting proxyDuration seconds and we compare it against proxyMinimumRequiredValidity in setCredentials().

Since the pilot bundles its own proxy, the proxy used by the Site Director is only useful to interact with the CE, am I wrong? So the proxyMinimumRequiredValidity should always be rather low.

What do you think?

Copy link
Contributor Author

@fstagni fstagni Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This proxy is indeed only for interacting with the CE, but it's not only for submission of the pilot: it is also for monitoring its status. So, it should actually be quite long.

Copy link
Contributor

@aldbr aldbr Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, so what do you think? Is 86400 seconds not long enough? (VOs will anyway be limited by the maximum duration setting)

Then for submitting jobs, proxyMinimumRequiredValidity could be just 1h, and for monitoring may be slightly more.

self.log.verbose("Getting pilot proxy", f"for {self.pilotDN}/{self.vo} {proxyMinimumRequiredValidity} long")
pilotGroup = Operations(vo=self.vo).getValue("Pilot/GenericPilotGroup")
result = gProxyManager.getPilotProxyFromDIRACGroup(self.pilotDN, pilotGroup, proxyMinimumRequiredValidity)
if not result["OK"]:
return result
result_validity = result["Value"].getRemainingSecs()
if not result_validity["OK"]:
return result_validity
if result_validity["Value"] < proxyMinimumRequiredValidity:
self.log.warn(
f"The validity of the generated proxy ({result_validity['Value']} seconds) is less than the requested {proxyMinimumRequiredValidity} seconds"
)
ce.setProxy(result["Value"])

# Get valid token if needed
Expand Down
Loading