Releases¶

HTCondor-CE 5 is distributed via RPM and are available from the following Yum repositories:

Known Issues¶

Known bugs affecting HTCondor-CEs can be found in Jira In particular, the following bugs are of note:

C-style comments, e.g. /* comment */, in JOB_ROUTER_ENTRIES will prevent the JobRouter from routing jobs (HTCONDOR-864). For the time being, remove any comments if you are still using the deprecated syntax.

Updating to HTCondor-CE 5¶

Finding relevant configuration changes

When updating HTCondor-CE RPMs, .rpmnew and .rpmsave files may be created containing new defaults that you should merge or new defaults that have replaced your customzations, respectively. To find these files for HTCondor-CE, run the following command:

root@host # find /etc/condor-ce/ -name '*.rpmnew' -name '*.rpmsave'

HTCondor-CE 5 is a major release that adds many features and overhauls the default configuration. As such, upgrades from older versions of HTCondor-CE may require manual intervention:

Support for ClassAd transforms added to the JobRouter¶

Transforms will override JOB_ROUTER_ENTRIES routes with the same name

Even if you do not plan on immediately using the new syntax, it's important to note that route transforms will override JOB_ROUTER_ENTRIES routes with the same name. In other words, the route transform names returned by condor_ce_config_val -dump -v JOB_ROUTER_ROUTE_ should only appear in your list of used routes returned by condor_ce_config_val JOB_ROUTER_ROUTE_NAMES if you intend to use the new transform syntax.

HTCondor-CE now includes default ClassAd transforms equivalent to its JOB_ROUTER_DEFAULTS, allowing administrators to write job routes using the transform synatx. The old syntax continues to be the default in HTCondor-CE 5. Writing routes in the new syntax provides many benefits including:

Statements being evaluated in the order they are written
Use of variables that are not included in the resultant job ad
Use of simple case statements.

Additionally, it is now easier to include transforms that should be evaluated before or after your routes by including transforms in the lists of JOB_ROUTER_PRE_ROUTE_TRANSFORM_NAMES and JOB_ROUTER_PRE_ROUTE_TRANSFORM_NAMES, respectively. To use the new transform syntax:

Disable use of JOB_ROUTER_ENTRIES by setting the following in /etc/condor-ce/config.d/:
```
JOB_ROUTER_USE_DEPRECATED_ROUTER_ENTRIES = False
```
Set JOB_ROUTER_ROUTE_<ROUTE_NAME> to a job route in the new transform syntax where <ROUTE_NAME> is the name of the route that you'd like to be reflected in logs and tool output.
Add the above <ROUTE_NAME> to the list of routes in JOB_ROUTER_ROUTE_NAMES

New `condor_mapfile` format and locations¶

HTCondor-CE 5 separates its unified mapfile used for authentication between multiple files across multiple directories. Additionally, any regular expressions in the second field must be enclosed by /. To update your mappings to the new format and location, perform the following actions:

Upon upgrade, your existing mapfile will be moved to /etc/condor-ce/condor_mapfile.rpmsave. Remove any of the following lines provided by default in the HTCondor-CE packaging:

GSI (.*) GSS_ASSIST_GRIDMAP
SSL "[-.A-Za-z0-9/= ]*/CN=([-.A-Za-z0-9/= ]+)" \1@unmapped.htcondor.org
CLAIMTOBE .* anonymous@claimtobe
FS "^(root|condor)$" \1@daemon.htcondor.org
FS "(.*)" \1

Copy the remaining contents of /etc/condor-ce/condor_mapfile.rpmsave to a file ending in *.conf in /etc/condor-ce/mapfiles.d/. Note that files in this folder are parsed in lexicographic order.
Update the second field of any existing mappings by enclosing any regular expressions in /, escaping any slashes with a backslash (e.g. \/).
- Consider converting any GSI mappings into Perl Compatible Regular Expressions (PCRE) since the authenticated name of incoming proxies may contain additional VOMS FQANs in addition to the Distinguished Name (DN):
```
<DN>,<VOMS FQAN 1>,<VOMS FQAN 2>,...,<VOMSFQAN N>
```
  For example, to accept a given DN with any VOMS attributes, the mapping should look like the following:
```
GSI /^\/DC=org\/DC=cilogon\/C=US\/O=University of Wisconsin-Madison\/CN=Brian Lin A226624,.*/ blin
```
  Alternatively, to accept any DN from the OSG VO:
```
GSI /.*,\/osg\/Role=Pilot\/Capability=.*/ osg
```
- Also consider converting SCITOKENS mappings to PCRE since the authenticated name of incoming tokens will contain the token issuer (iss) and any token subject (sub) fields:
```
<TOKEN ISSUER>,<TOKEN SUB>
```
  For example, to accept a token issued by the OSG VO with any subject, write the following mapping:
```
SCITOKENS /^https:\/\/scitokens.org\/osg-connect,.*/ osg
```

Specify certificate locations for token authentication¶

HTCondor-CE 5 adds improved support for accepting pilot jobs submitted with bearer tokens (e.g., SciTokens or WLCG tokens). As part of the bearer token authentication, HTCondor-CE uses its host certificate to perform an SSL handshake with the client to establish trust with its token issuer. Consult the authentication documentation to configure certificate locations for token authentication.

No longer set `$HOME` by default¶

Older versions of HTCondor-CE set $HOME in the routed job to the user's $HOME directory on the HTCondor-CE. To re-enable this behavior, set USE_CE_HOME_DIR = True in /etc/condor-ce/config.d/.

HTCondor-CE 5 Version History¶

This section contains release notes for each version of HTCondor-CE 5. Full HTCondor-CE version history can be found on GitHub.