Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
wiki:some_examples_of_admission_rules [2017/05/10 10:49]
neyron [Example 5:]
wiki:some_examples_of_admission_rules [2017/05/11 15:32] (current)
mvesin [Example 5:]
Line 169: Line 169:
  
 ==Answer== ==Answer==
-  * First add a property to resources: //​dedicated=none// or //​dedicated=team_name//​ for nodes owned by each team.+  * First add a property to resources: //​dedicated=NO// or //​dedicated=team_name//​ for nodes owned by each team.
   * Then add an admission rule which describes the team list with regard to unix users and groups.   * Then add an admission rule which describes the team list with regard to unix users and groups.
-  * Non-besteffort jobs will automatically bound to resources set with //​dedicated=none//, except for members of one of the defined teams, whose jobs are automatically directed to their dedicated resources (//​dedicated=team_of_the_user//​).+  * Non-besteffort jobs will automatically bound to resources set with //​dedicated=NO//, except for members of one or more of the defined teams, whose jobs are automatically directed to the union of their dedicated resources (//​dedicated=team_of_the_user//​) ​and the //​dedicated=NO//​ resources.
   * Besteffort jobs do not have constraints:​ they are scheduled on any resources with the property //​besteffort=YES//​ (usually all nodes). ​   * Besteffort jobs do not have constraints:​ they are scheduled on any resources with the property //​besteffort=YES//​ (usually all nodes). ​
  
 <code perl> <code perl>
-# Description : set dedicated property+# Description : set dedicated property ​for exceptional usages
  
 my @projects; my @projects;
Line 186: Line 186:
 push(@projects,​ \%fluminance_project);​ push(@projects,​ \%fluminance_project);​
  
-my $dedicated_none ​0; +my $jobaddedprop ​"\( dedicated='​NO'" ​;
-my $user_in_one_group ​0;+
  
-foreach my $project (@projects) { +# original : IGRIDA admission rule 
-  my @members; +# modified : nef @ Inria Sophia 
-  foreach (@{$project->​{'​groups'​}}) { +  
-    my $gr; +if (!(grep(/​^besteffort/,​ @{$type_list}))) { 
-    (undef,​undef,​undef,​ $gr) = getgrnam($_);​ +  # Any user can run besteffort jobs on any resource :  
-    my @group_members = split(/​\s+/,​$gr);​ +  # no additional verification,​ no modification 
-    push(@members, ​@group_members);​ + 
-  } +  # Search for projects to which the user belongs 
-  ​push(@members,​ @{$project->​{'​users'​}})+  ​foreach my $project (@projects) { 
-  my %h = map { $_ => 1 } @members; +    my @members; 
-  if ( $h{$user} eq 1 ) { +    foreach (@{$project->​{'​groups'​}}) { 
-    if (!(grep(/​dedicated(\s+|)=/,​ $jobproperties))){ +      my $gr; 
-      $jobproperties = "​($jobproperties) AND dedicated = \'​$project->​{'​dedicated'​}\'";​ +      (undef,​undef,​undef,​ $gr) = getgrnam($_);​ 
-      print("​[ADMISSION RULE] Automatically add the constraint to go on the $project->​{'​dedicated'​} dedicated nodes.\n"​);​ +      my @group_members = split(/​\s+/,​$gr);​ 
-      $user_in_one_group = 1;+      #​print(@group_members);​ 
 +      push(@members,​ @group_members);
     }     }
-  ​else +    push(@members,​ @{$project->​{'​users'​}}); 
-    if (!(grep(/​dedicated(\s+|)=/, ​$jobproperties))) { +    my %h = map $_ => 1 } @members; 
-      $dedicated_none ​1+ 
-    } +    if ( $h{$user} eq 1 ) { 
-    if ((grep(/​dedicated(\s+|)=(\s+|)'​$project->​{'​dedicated'​}\'/,​ $jobproperties)) and !(grep(/​^besteffort/,​ @{$type_list}))) { +      ​#print($user); 
-      die("​[ADMISSION RULE] $project->​{'​dedicated'​} dedicated nodes are only available for best-effort jobs.\n"​);​+      $jobaddedprop ." OR dedicated=\'​$project->​{'​dedicated'​}\'"​
 +    } else { 
 +      if ((grep(/​dedicated(\s+|)=(\s+|)'​$project->​{'​dedicated'​}\'/,​ $jobproperties))) { 
 +        die("​[ADMISSION RULE] $project->​{'​dedicated'​} dedicated nodes are only available for best-effort jobs.\n"​);​ 
 +      }
     }     }
   }   }
-} 
  
-if (($dedicated_none ​== 1and ($user_in_one_group == 0) and ($queue_name ne "​admin"​)) { +  ​$jobaddedprop ." \)"; 
-  if (!(grep(/^besteffort/, @{$type_list}))) { + 
-    $jobproperties = "​($jobproperties) AND dedicated ​= \'​none\'​";+  # Always need to limit request to permitted nodes 
 +  if ($queue_name ne "​admin"​) { 
 +    if (grep(/\S/, $jobproperties)) { 
 +      $jobproperties = "​($jobproperties) AND $jobaddedprop";​ 
 +    } else { 
 +      $jobproperties ​"​$jobproperties $jobaddedprop";​ 
 +    } 
 +    print("​[ADMISSION RULE] Automatically add constraint to go on nodes permitted for the user.\n");
   }   }
 +
 } }
 </​code>​ </​code>​
Line 224: Line 235:
 That set up: That set up:
   * For a user of team '​serpico'​ : ''​$ oarsub -I''​   * For a user of team '​serpico'​ : ''​$ oarsub -I''​
-    * => property set: ''​dedicated = '​serpico'''​ +    * => property set: ''​dedicated='​NO'​ OR dedicated='​serpico'''​ 
-  * That user can also use non dedicated nodes: ''​$ oarsub -I -p "​dedicated='​none'"''​ +  * That user can also force use of dedicated nodes only: ''​$ oarsub -I -p "​dedicated='​serpico'"''​ 
-    * => property set: ''​dedicated='​none'''​ +    * => property set: ''​dedicated='​serpico'''​ 
-  * For a user that does not belong to a team which owns nodes1: ''​$ oarsub -I''​ +  * For a user of teams '​serpico'​ and '​neurinfo':​ ''​$ oarsub -I''​ 
-    * => property set: ''​dedicated = 'none'''​+    * => property set: ''​dedicated='​NO'​ OR dedicated='​serpico'​ OR dedicated='​neurinfo'''​ 
 +  * For a user that does not belong to a team which owns nodes: ''​$ oarsub -I''​ 
 +    * => property set: ''​dedicated='​NO'''​
   * And for that user: ''​$ oarsub -I -p "​dedicated='​serpico'"''​   * And for that user: ''​$ oarsub -I -p "​dedicated='​serpico'"''​
     * => ''​ERROR : [ADMISSION RULE] serpico dedicated nodes are only available for best-effort jobs.''​     * => ''​ERROR : [ADMISSION RULE] serpico dedicated nodes are only available for best-effort jobs.''​
   * But with: ''​$ oarsub -I -t besteffort''​ he can get jobs running on the dedicated nodes, which however will be stopped as soon as a job of a member of the owners'​ team need the nodes.   * But with: ''​$ oarsub -I -t besteffort''​ he can get jobs running on the dedicated nodes, which however will be stopped as soon as a job of a member of the owners'​ team need the nodes.
  
-(Note that there are some known limitations in that property filtering, which could allow malicious users to overcome the usage policy)+(There may be some limitations in that property filtering, which could allow malicious users to overcome the usage policy)
  
wiki/some_examples_of_admission_rules.txt · Last modified: 2017/05/11 15:32 by mvesin
Recent changes RSS feed GNU Free Documentation License 1.3 Donate Powered by PHP Valid XHTML 1.0 Valid CSS Driven by DokuWiki