Skip to content

[BUG] JobManager refactoring creates a bad behaviour with filterJobStateTransition #8272

@Robin-Van-de-Merghel

Description

@Robin-Van-de-Merghel

JobManager if a client calls killJob, DIRAC itself will call a client, with DIRAC "auth power".

Why

  1. At the beginning, killJob is in an handler with DIRAC credentials and not the user's.
  2. After [9.0] Move the logic out of the server (cleaning and deleting jobs) #8244 's refactoring, filterJobStateTransition calls res = JobMonitoringClient().getJobsStatus(jobIDs) which is bad because it is with DIRAC credentials, and not the user's.

Impact

  1. In DIRAC, "it works" as DIRAC has its own credentials, but it's not an expected behaviour.
  2. With DiracX, it maybe won't work as DIRAC is not a valid user in the CS.
  3. In CI with DiracX (how it was detected), it won't work because DIRAC own certificate used for DiracX does not exist:
AssertionError: FileNotFoundError(2, 'No such file or directory'): [Errno 2] No such file or directory: '/tmp/x509up_u501'

# Stack
68.117.5]:57294)[prod:ciuser] (0.13 secs) ERROR: FileNotFoundError(2, 'No such file or directory'): [Errno 2] No such file or directory: '/tmp/x509up_u501'
  File "/home/dirac/LocalRepo/ALTERNATIVE_MODULES/DIRAC/src/DIRAC/Core/Utilities/ReturnValues.py", line 238, in wrapped
    value = func(*args, **kwargs)
            ^^^^^^^^^^^^^^^^^^^^^
  File "/home/dirac/LocalRepo/ALTERNATIVE_MODULES/DIRAC/src/DIRAC/WorkloadManagementSystem/FutureClient/JobMonitoringClient.py", line 35, in getJobsStatus
    return self.fetch(["Status"], jobIDs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/dirac/LocalRepo/ALTERNATIVE_MODULES/DIRAC/src/DIRAC/WorkloadManagementSystem/FutureClient/JobMonitoringClient.py", line 10, in fetch
    with DiracXClient() as api:
  File "/home/dirac/ServerInstallDIR/diracos/lib/python3.11/contextlib.py", line 137, in __enter__
    return next(self.gen)
           ^^^^^^^^^^^^^^
  File "/home/dirac/LocalRepo/ALTERNATIVE_MODULES/DIRAC/src/DIRAC/Core/Security/DiracX.py", line 99, in DiracXClient
    diracxToken = diracxTokenFromPEM(proxyLocation)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/dirac/LocalRepo/ALTERNATIVE_MODULES/DIRAC/src/DIRAC/Core/Security/DiracX.py", line 77, in diracxTokenFromPEM
    pem = Path(pemPath).read_text()
          ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/dirac/ServerInstallDIR/diracos/lib/python3.11/pathlib.py", line 1058, in read_text
    with self.open(mode='r', encoding=encoding, errors=errors) as f:
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/dirac/ServerInstallDIR/diracos/lib/python3.11/pathlib.py", line 1044, in open
    return io.open(self, mode, buffering, encoding, errors, newline)

Note: Maybe there's other weird calls like this... We only detected it because of the CI with DiracX

Metadata

Metadata

Assignees

Labels

Type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions