Upgrading from an 9.0 LTS version to an 10.0 LTS version of HTCondor

Upgrading from a 9.0 LTS version of HTCondor to a 10.0 LTS version will bring new features introduced in the 9.x versions of HTCondor. These new features include the following (note that this list contains only the most significant changes; a full list of changes can be found in the version history: Version 9 Feature Releases):

• Users can prevent runaway jobs by specifying an allowed duration. (HTCONDOR-820) (HTCONDOR-794)

• Able to extend submit command and create job submit template. (HTCONDOR-802) (HTCONDOR-1231)

• Initial implementation of the htcondor <noun> <verb> command line interface. (HTCONDOR-252) (HTCONDOR-793) (HTCONDOR-929) (HTCONDOR-1149)

• Initial implementation of Job Sets in the htcondor CLI tool

• Users can supply a container image without concern for which container runtime will be used on the execution point. (HTCONDOR-850)

• Add the ability to select a particular model of GPU when the execution points have heterogeneous GPU cards installed or cards that support nVidia MIG (HTCONDOR-953)

• File transfer error messages are now returned and clearly indicate where the error occurred (HTCONDOR-1134)

• GSI Authentication method has been removed (X.509 proxies are still handled by HTCondor) (HTCONDOR-697)

• HTCondor now utilizes ARC-CE’s REST interface (HTCONDOR-138) (HTCONDOR-697) (HTCONDOR-932)

• Support for ARM and PowerPC for Enterprise Linux 8 (HTCONDOR-1150)

• For IDTOKENS, signing key is not required on every execution point (HTCONDOR-638)

• Trust on first use ability for SSL connections (HTCONDOR-501)

• Improvements against replay attacks (HTCONDOR-287) (HTCONDOR-1054)

Upgrading from a 9.0 LTS version of HTCondor to a 10.0 LTS version will also introduce changes that administrators and users of sites running from an older HTCondor version should be aware of when planning an upgrade. Here is a list of items that administrators should be aware of.

• The default for TRUST_DOMAIN, which is used by with IDTOKEN authentication, has been changed to $(UID_DOMAIN). (HTCONDOR-1381)

  If you have already created IDTOKENs for use in your pool:

  1. Log in as root on a machine with an IDTOKEN.

  2. Run condor_token_list and retrieve the value of the iss field.

  3. Set the HTCondor configuration TRUST_DOMAIN to that value on each machine which should accept IDTOKENs;

  4. Restart HTCondor on those machines.

• Jobs that use a Requirements expression to try and match to specific a GPU should be changed to use the new require_gpus submit command or jobs will simply not match. If your machines have only a single type of GPU, you may be able to modify the machine configuration to allow users to delay having to make this change. This is a consequence of the fact that multiple GPUs of different types in a single machine is now supported. Attributes such as CUDACapability will no longer be advertised because it is not reasonable to assume that all GPUs will have a single value for this property. Instead the properties of each GPU will be advertised individually in a format that allows a job to request it run on a specific GPU or type of GPU. See Jobs That Require GPUs for more information on about the require_gpus submit command. (HTCONDOR-953)

• We have updated to using the PCRE2 regular expression library. This library is more strict with interpreting regular expression. If the regular expressions are properly constructed, the will be no difference in interpretation. However, some administrators have reported that expressions in their condor mapfile were rejected because they wanted to match the - character in a character class and the - was not the last character specified in the character class. In addition, on Enterprise Linux 7, having a hyphen (-) in the last position after a POSIX character set (such as [:space:]) in a character class was flagged as an invalid range, even though it should have been accepted. (HTCONDOR-1087)

• The semantics of undefined user job policy expressions has changed. A policy whose expression evaluates to undefined is now uniformly ignored, instead of either putting the job on hold or treated as false. (HTCONDOR-442)