HTCondor CE plans to end support for X509 in November

[zhangxiaomei]

I just got a message from one of our HTCondorCE site: "HTCondor CE plans to end support for X509 in November". It has been also mentioned in the WLCG GDB resport on March 7:
https://indico.cern.ch/event/1096028/contributions/4761502/attachments/2404855/4113577/Token-Transition-Timeline-220309.pdf
and HTCondor web site:
https://htcondor-wiki.cs.wisc.edu/index.cgi/wiki?p=PlanToReplaceGridCommunityToolkit
Since most of our site is using HTCondorCE, does that mean we have to migrate to the latest DIRAC release 8.0 to cope with that or have other ways?

[aldbr]

From what I know:

• Developers of HTCondor decided to extend the support of v9.0.x (which supports GSI - Grid Infrastructure Security - by default) until February 1st 2023.
  • source: https://htcondor-wiki.cs.wisc.edu/index.cgi/wiki?p=PlanToReplaceGridCommunityToolkit
• From v9.1.3, GSI is no longer in the list of the default authentication methods.
  • from this point, to use GSI for proxy delegation, you have to explicitly specify it before interacting with HTCondor, such as:

    export _condor_SEC_DEFAULT_AUTHENTICATION_METHODS="GSI,TOKEN,SCITOKEN,SSL,FS"

  • source: https://htcondor.readthedocs.io/en/v9_1/version-history/development-release-series-91.html#version-9-1-3
• From v9.3, GSI is removed.
  • source: https://htcondor.readthedocs.io/en/v9_1/version-history/development-release-series-91.html#version-9-1-3
• GSI will be replaced by tokens.

Currently, in DIRAC v8.0, we are still using HTCondor v9.1.2, which does not cope with the issue.
The integration of tokens within DIRAC is progressing in v8.0, I am not sure when it will be ready though.

Thus my answer is: we have not started to work on this issue, but I am pretty sure we will from DIRAC >= v8.0.
You will have to migrate to a newer version of DIRAC >= v8.0

[aldbr]

Further details about the HTCondor version scheme in case you are lost with all these versions:

• The current LTS version is v9.0.11
• The next LTS version is v10.0.0 and will be released in May 2022.
• Developers usually support the previous release for 6 months (but they will extend the support of v9.0.x until February)
• v9.1.x, v9.2.0 and v9.3.0 are feature releases.
• source: https://htcondor.readthedocs.io/en/latest/version-history/introduction-version-history.html

[zhangxiaomei]

Thank you very much for the detailed reply! It is clear to me. I try to know more about site HTCondor version plans.

[fstagni]

And from DIRAC point of view: the full "certified" support will probably come with DIRAC v8.1

[ernstpijper]

Is it possible to update from v7.13.x(py3) to v8.1 or does it require a complete reinstall.

[fstagni]

There is no v8.1, because there's not even v8.0 ready at the moment. For v8.1 we are talking about several months from now.
It will be possible to update from v7.3 to v8.0 and then to v8.1 without re-install.