Operations Management Board

Adobe connect direct link


Alessandro Paolini (EGI Foundation)
Bruce Becker
Christos (GRNET)
Dave Kelsey (Security)
Dragos Ciobanu-Zabet (NGI_RO)
Emir Imamagic
George Ryall (STFC -GOCDB)
Ionut Vasile (NGI_RO)
Jan Astalos (NGI_SK)
Jeremy Coles (NGI_UK)
Kostas Koumantaros
Linda Cornwall (STFC)
Miroslav Ruda
Nicolas Liampotis (GRNET)
Peter  Solagna
Themis Zamani (GRNET)
Viet Tran (IISAS)
Vincent Brillault (EGI CSIRT)
Vincenzo Spinoso

List of new actions

ACTION: EGI operations will open tickets to other NGIs asking for storage accounting volunteers (only DPM/dCache SE)

ACTION (EGI Ops): create a scope tag for the cloud sites

ACTION (EGI Ops): review with Vincent the SEC05 and PROC09 documents to see if readability can be improved

ACTION: to produce some documentation about the monitoring of uncertified sites and modify accordingly the certification procedure


3 policies will be endorsed by EB (next monday), replacing the previous versions.

Creation of a new service type, webdav, for properly monitoring the services exposing this interface.

Storage accounting: 10 sites are publishing storage accounting data.
Apel would have at least one site per NGI deploying the new probes for testing purposes;
ACTION: EGI operations will open ticket to other NGIs asking for volunteers (only DPM/dCache SE)

UMD 4.4.0 is in preparation
CMD-OS 1.0.0 was released on December

Next EGI conference 8th - 12th May 2017 (Catania, Italy)
joint event with INDIGO Datacloud
1 session planned is roadmaps of NGIs Operations (joint double session with NGI Outreach teams)

Security update

Vincent Brillault reported on some security topics

No new critical vulnerability, only 4 new incidents: 2 regarding user VMs (R/W folder via NFS and poorly configured system)
1 DPM node compromised
1 system used for bitcoin mining

for reporting security incident please use the mailing list abuse@egi.eu
proposed to modify the security certification procedure for using this list for tracking the sites certification requests (it will be opened a RT ticket)

needed more security contacts:
a mailing-list for FedCloud RCs separated form the HTC ones
VA owners and endorsers
VM operator role

There is no way for filter the cloud sites with a goc-db query for getting their mailing list, we could try to add a tag to the cloud sites.

In case you want to use the service contacts:

- they are not (yet) mandatory

- they also need to be validated

the easy way could be creating and adding a scope tag to the cloud sites

ACTION (EGI Ops): create a scope tag for the cloud sites

ACTION (EGI Ops): review with Vincent the SEC05 and PROC09 documents to see if readability can be improved

GPGPU for the cloud

Viet Tran presented the status of GPGPU activity

1 openstack GPGPU site at IISAS-GPGPUCloud, predefined images with NVIDIA drivers and CUDa tools

access through either rOCCI client or via Horizon dashboard (login via token), support for DOCKER applications

In the new site IISAS-Nebula, the access is via rOCCI

Several applications using GPGPU: machine learning, artificial neural networks and patten recognitions, bioinfomratics

produced documentation (egi wiki): user tutorial, site admin guide, additional tools

work in progress: GLUE2.1 schema, GPU accounting, GPGPU support with LXC/LXD hypervisor,
new sites will join soon to fedcloud

plans to migrate to Openstasck Mitaka (from Kilo), some modification in the conf to support GPGPU

invite the other NGIs to participate in case of GPGPU reources availability: Open Nebula and OpenStack sites can contact Viet to get support if they want to expose GPGPUs

Comment by Vincenzo Spinoso: about CREAM support for GPGPG a new testbed is going to be deployed at CERN, going to get more news at the end of this week

EGI CheckIn udpate

Peter solagna reported the status of EGI Checkin service

platform to enable A&A (heterogeneous) infrastructures in EGI

access to EGI service by using the own credentials (provided by the home organixzations IdP)
different level of assurance will be accepted and handled
every EGI service should support either x509 certificates or CheckIn or both
Users identified by: certificateDN, EGI UID (in case they may be linked within CheckIn)

timeline: in february a beta version, in march beta access to fedcloud without a certificate

one LoA currently
enable the OIDC support,

RC Auth operated by NIKHEF
now integrated with CheckIn, it can be used only with authorized VOs
the whole process needs to be formalized

checkIn is federated in eduGAIN

work in progress:
translation of VO info from SAML/OIDC into VOMS proxy
provisioning of VOMS info through SAML and OIDC interfaces

ARGO developments update

Emir Imamagic presented the recent updates in ARGO

1 instance (almost ready) for testing uncertified sites

ACTION: to produce some documentation and modify accordingly the certification procedure

1 instance for testing new probes

created a profile on POEM containing only cloud services

developments: migration to new messaging system, use of notification system; there are a lot of request from NGIs to enable it

it will be available in the following months

There are minutes attached to this event. Show them.
    • 10:00 AM 10:15 AM
      Introduction 15m
      Speaker: Peter Solagna (EGI.eu)
    • 10:15 AM 10:35 AM
      Security update 20m
      Speakers: Dr Sven Gabriel (NIKHEF), Vincent Brillault (CERN)
    • 10:35 AM 10:55 AM
      GPGPU for the cloud 20m
      Speaker: Dr Viet Tran (UI SAV)
    • 10:55 AM 11:15 AM
      EGI CheckIn udpate 20m
      Speaker: Peter Solagna (EGI.eu)
    • 11:15 AM 11:35 AM
      ARGO developments update 20m
      Speaker: Mr Emir Imamagic (SRCE)
    • 11:35 AM 11:45 AM
      AOB 10m