Notes - 04-catservices (WIP)

[katilp]

• This is presumably valid only in the context of CMSDAS:

  You can move the project you have been using so far in this lesson to the cms-analysis namespace by going to Settings –> General –> Advanced –> Transfer project and select cms-analysis / CMSDAS / CAT-tutorials as a new namespace. The cms-analysis / CMSDAS / CAT-tutorials is to be used for the purpose of testing.

  I cannot select that namespace: it does not show up in the menu from which I can select. And in any case, the repository name (used so far in this tutorial) is already in use there
  I guess that a namespace should be created specifically for each tutorial session and participants should be added as members. And they should be advised to select a unique repository name (e.g. awesome-gitlab-cms-$USER) as the transfer options does not allow changes in the repository name.

• Mention the motivation ("You won’t need to expose any personal credentials.") already in the text under the titke "Using the CAT EOS file service". Now it only appear in the key points.

• In the CAT EOS exercise, the text advises to use

  proxy=$(curl --fail-with-body -H "Authorization: ${MY_JOB_JWT}" "https://cms-cat-grid-proxy-service.app.cern.ch/api" | tr -d \")
  

  but the yml example has

  'proxy=$(curl -H "Authorization: ${MY_JOB_JWT}" "https://cms-cat-grid-proxy-service.app.cern.ch/api" | tr -d \")' 
  

  is --fail-with-body needed? FWIW, for me (curl 7.68.0), that option gives curl: option --fail-with-body: is unknown but it is OK on LXPLUS (curl 7.76.1)

The exercise not tested, yet. It needs a repo under CERN GitLab cms-analysis area.

[lenzip]

One possibility to make the tutorial usable asynchronously would be that I create an e-group with a self subscription policy and add an LDAP synchronization with Maintainer access to cms-analysis / CMSDAS / CAT-tutorials.

How about this option? Maybe @clelange has comments as well.

[clelange]

The egroup would also what I would have suggested initially. It's a bit risky though if everyone gets maintainer access to that area since everyone would then also have access to the repositories in that area. Instead, we should probably have a cron job that automatically creates an area per account for each account subscribed to the egroup. Also, egroup synchronisation is slow.

Instead, we could create a small webpage that allows people who are in cms-physics-access (or similar) to create such an area. This would then happen immediately.

Then we could also have a cron job that cleans up this area 60 days after no activity, but that's maybe not that important.

[clelange]

Here's something for people with cms-physics-access: https://cms-cat-tutorials.web.cern.ch/
Once a few people have tested it, we can update the tutorial.