Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
Next revisionBoth sides next revision
wiki:some_examples_of_admission_rules [2017/05/10 10:47] neyronwiki:some_examples_of_admission_rules [2017/05/11 15:32] – [Example 5:] mvesin
Line 164: Line 164:
  
 ==== Example 5:  ==== ==== Example 5:  ====
-Give a more privilege to the owners (e.g. people who payed for the nodes) of nodes to submit, by restricting others to besteffort jobs:  +Give a more privilege to the owners of nodes (e.g. people who payed for the nodes) to submit, by restricting others to besteffort jobs:  
-  * non-owner compete on the resources according to the scheduling policy of the besteffort queue ; +  * non-owners compete on the resources according to the scheduling policy of the besteffort queue ; 
-  * but owners can get jobs running, just like if those jobs did not exist (i.e. besteffort jobs are killed whenever non besteffort jobs require the same resources) +  * but owners can get jobs running, just like if those jobs did not exist (i.e. besteffort jobs are killed whenever non besteffort jobs require the same resources).
-This imply setting up a match between resources and users.+
  
 ==Answer== ==Answer==
-  * First add a property to resources: //dedicated=none// or //dedicated=team_name// for nodes owned by each team.+  * First add a property to resources: //dedicated=NO// or //dedicated=team_name// for nodes owned by each team.
   * Then add an admission rule which describes the team list with regard to unix users and groups.   * Then add an admission rule which describes the team list with regard to unix users and groups.
-  * Non-besteffort jobs will automatically bound to resources set with //dedicated=none//, except for members of one of the defined teams, whose jobs are automatically directed to their dedicated resources (//dedicated=team_of_the_user//).+  * Non-besteffort jobs will automatically bound to resources set with //dedicated=NO//, except for members of one or more of the defined teams, whose jobs are automatically directed to the union of their dedicated resources (//dedicated=team_of_the_user//and the //dedicated=NO// resources.
   * Besteffort jobs do not have constraints: they are scheduled on any resources with the property //besteffort=YES// (usually all nodes).    * Besteffort jobs do not have constraints: they are scheduled on any resources with the property //besteffort=YES// (usually all nodes). 
  
 <code perl> <code perl>
-# Description : set dedicated property+# Description : set dedicated property for exceptional usages
  
 my @projects; my @projects;
Line 187: Line 186:
 push(@projects, \%fluminance_project); push(@projects, \%fluminance_project);
  
-my $dedicated_none 0; +my $jobaddedprop "\( dedicated='NO'" ;
-my $user_in_one_group 0;+
  
-foreach my $project (@projects) { +# original : IGRIDA admission rule 
-  my @members; +# modified : nef @ Inria Sophia 
-  foreach (@{$project->{'groups'}}) { +  
-    my $gr; +if (!(grep(/^besteffort/, @{$type_list}))) { 
-    (undef,undef,undef, $gr) = getgrnam($_); +  # Any user can run besteffort jobs on any resource :  
-    my @group_members = split(/\s+/,$gr); +  # no additional verification, no modification 
-    push(@members, @group_members); + 
-  } +  # Search for projects to which the user belongs 
-  push(@members, @{$project->{'users'}})+  foreach my $project (@projects) { 
-  my %h = map { $_ => 1 } @members; +    my @members; 
-  if ( $h{$user} eq 1 ) { +    foreach (@{$project->{'groups'}}) { 
-    if (!(grep(/dedicated(\s+|)=/, $jobproperties))){ +      my $gr; 
-      $jobproperties = "($jobproperties) AND dedicated = \'$project->{'dedicated'}\'"; +      (undef,undef,undef, $gr) = getgrnam($_); 
-      print("[ADMISSION RULE] Automatically add the constraint to go on the $project->{'dedicated'} dedicated nodes.\n"); +      my @group_members = split(/\s+/,$gr); 
-      $user_in_one_group = 1;+      #print(@group_members); 
 +      push(@members, @group_members);
     }     }
-  else +    push(@members, @{$project->{'users'}}); 
-    if (!(grep(/dedicated(\s+|)=/, $jobproperties))) { +    my %h = map $_ => 1 } @members; 
-      $dedicated_none 1+ 
-    } +    if ( $h{$user} eq 1 ) { 
-    if ((grep(/dedicated(\s+|)=(\s+|)'$project->{'dedicated'}\'/, $jobproperties)) and !(grep(/^besteffort/, @{$type_list}))) { +      #print($user); 
-      die("[ADMISSION RULE] $project->{'dedicated'} dedicated nodes are only available for best-effort jobs.\n");+      $jobaddedprop ." OR dedicated=\'$project->{'dedicated'}\'"
 +    } else { 
 +      if ((grep(/dedicated(\s+|)=(\s+|)'$project->{'dedicated'}\'/, $jobproperties))) { 
 +        die("[ADMISSION RULE] $project->{'dedicated'} dedicated nodes are only available for best-effort jobs.\n"); 
 +      }
     }     }
   }   }
-} 
  
-if (($dedicated_none == 1and ($user_in_one_group == 0) and ($queue_name ne "admin")) { +  $jobaddedprop ." \)"; 
-  if (!(grep(/^besteffort/, @{$type_list}))) { + 
-    $jobproperties = "($jobproperties) AND dedicated = \'none\'";+  # Always need to limit request to permitted nodes 
 +  if ($queue_name ne "admin") { 
 +    if (grep(/\S/, $jobproperties)) { 
 +      $jobproperties = "($jobproperties) AND $jobaddedprop"; 
 +    } else { 
 +      $jobproperties "$jobproperties $jobaddedprop"; 
 +    } 
 +    print("[ADMISSION RULE] Automatically add constraint to go on nodes permitted for the user.\n");
   }   }
 +
 } }
 </code> </code>
Line 225: Line 235:
 That set up: That set up:
   * For a user of team 'serpico' : ''$ oarsub -I''   * For a user of team 'serpico' : ''$ oarsub -I''
-    * => property set: ''dedicated = 'serpico''' +    * => property set: ''dedicated='NO' OR dedicated='serpico''' 
-  * That user can also use non dedicated nodes: ''$ oarsub -I -p "dedicated='none'"'' +  * That user can also force use of dedicated nodes only: ''$ oarsub -I -p "dedicated='serpico'"'' 
-    * => property set: ''dedicated='none''' +    * => property set: ''dedicated='serpico''' 
-  * For a user that does not belong to a team which owns nodes1: ''$ oarsub -I'' +  * For a user of teams 'serpico' and 'neurinfo': ''$ oarsub -I'' 
-    * => property set: ''dedicated = 'none'''+    * => property set: ''dedicated='NO' OR dedicated='serpico' OR dedicated='neurinfo''' 
 +  * For a user that does not belong to a team which owns nodes: ''$ oarsub -I'' 
 +    * => property set: ''dedicated='NO'''
   * And for that user: ''$ oarsub -I -p "dedicated='serpico'"''   * And for that user: ''$ oarsub -I -p "dedicated='serpico'"''
     * => ''ERROR : [ADMISSION RULE] serpico dedicated nodes are only available for best-effort jobs.''     * => ''ERROR : [ADMISSION RULE] serpico dedicated nodes are only available for best-effort jobs.''
   * But with: ''$ oarsub -I -t besteffort'' he can get jobs running on the dedicated nodes, which however will be stopped as soon as a job of a member of the owners' team need the nodes.   * But with: ''$ oarsub -I -t besteffort'' he can get jobs running on the dedicated nodes, which however will be stopped as soon as a job of a member of the owners' team need the nodes.
  
-(Note that there are some known limitations in that property filtering, which could allow malicious users to overcome the usage policy)+(There may be some limitations in that property filtering, which could allow malicious users to overcome the usage policy)
  
wiki/some_examples_of_admission_rules.txt · Last modified: 2020/04/07 22:01 by neyron
Recent changes RSS feed GNU Free Documentation License 1.3 Donate Powered by PHP Valid XHTML 1.0 Valid CSS Driven by DokuWiki