GitLab

it goes through normal emulab permission checks.

* The Emulab portal now adds a toplevel element (Emulab namespace)
  directing the CM to use standard emulab mounts (read: /users).
  We clear that element from the other portals.

* The CM looks for that tag, and allows it only if the caller is the local
  SA. The default for nfsmounts setting for geni experiment containers is
  "genidefault", but that is set to "emulabdefault" when allowed.

* tmcd changes; no using nfsmounts slot instead of nonfsmounts. "none"
  means no mounts (duh), "emulabdefault" means standard mounts we all know
  and love, "genidefault" means no /users mounts.

  In addition, when we are doing emulabdefault mounts on a geni experiment
  node, we do not return accounts that are specified in the rspec, but
  rather we return the local project accounts only.

error.

"failed" status, but not show the error in the error panel.

instantiate page is completely messed up, so no plan to release to general
public until Keith can look at it.

pre-reserved or sched-reserved nodes. I do this by adding a privilege to
the credential we create in APT_Instance::Extend(), so technically anyone
can do this, but I also send email to the local tbops list when it happens,
so we will see abuse right away.

apt_aggregates table. Also check the adminonly flag.

errors properly (not enough nodes, not enough bandwidth, etc) rather then
everything just getting "stitcher error". This will make the numbers on the
dashboard page look much better!

as a parameter (pub part), and the priv key into create_instance.

1) Anytime we need to generate a slice credential, and the slice has
   expired, bump the slice expiration so we can create a valid credential
   and then reset the expiration. Consider if the slice expires but we
   missed it and its still active; we gotta be able to control it.

2) From the beginning, we have done almost all RPC operations as the
   creator of the experiment. Made sense when the portal interface was not
   project aware, but now other users in the project can see and mess with
   experiments in their project. But we are still doing all the RPC
   operations as the creator of the experiment, which will need to change
   at some point, but in the short term I am seeing a lot of credential
   errors caused by an expired speaks-for credential for that creator (if
   they have not logged into the portal in a while). When this happens,
   lets generate a plain slice credential, issued to the SA, so that we can
   complete the operation. Eventually we have to make the backend project
   aware, and issue the operations as the web user doing the driving.
   Maybe as part of the larger portalization project.

update from two places (here, and from the apt event daemon).

1. Do not allow guest users to use anything but the APT cluster. We had
   talked about this a while back, and today it caused a problem:

2. Because a guest tried to use the Mothership (cause of a URN in the
   profile), we had GeniUser lookup confusion. We store guest users in the
   geni-sa geni_users table, but because PROTOGENI_LOCALUSER=1, we end up
   creating a nonlocal account on the Geni path, and that conflicts.
   Changed how we do lookups.

Portal, what clusters are usable by each portal, ditto datasets. Remove
all hardwired cluster urns and urls.

waiting till it finished setting up (or fails). This is really nice when a
1000 node experiment has gone awry and it is pointless to wait for it to
finish. When we do this, we mark the instance as canceled in the DB, and
then wait for create_instance() to notice it. When it does, it stops
waiting and invokes terminate with a new cancel option at the backend.

wait time to 15 minutes, but watch for progress. Any time a node changes
bump the waiting time above five minutes. Just a start point, lets
see how it goes.

big topologies.

with BADARGS; stitcher always exists with 1, and I've not been able to
fix that.

dashboard page.

to be decrypted using the per-exp ssl keypair we create and store on the
nodes. In this case, you can add this to your rspec in the node element.
You can add as many as you want, use the name attribute. We generate a
random password and encrypt the plain text:

  <emulab:password></emulab:password>

which becomes:

    <emulab:password name="foo" encrypted="true">-----BEGIN PKCS7-----
MIIBpAYJKoZIhvcNAQcDoIIBlTCCAZECAQAxggFMMIIBSAIBADCBsDCBqDELMAkG
A1UEBhMCVVMxDTALBgNVBAgTBFV0YWgxFzAVBgNVBAcTDlNhbHQgTGFrZSBDaXR5
MR0wGwYDVQQKExRVdGFoIE5ldHdvcmsgVGVzdGJlZDEPMA0GA1UECxMGQVBUTEFC
MRcwFQYDVQQDEw53d3cuYXB0bGFiLm5ldDEoMCYGCSqGSIb3DQEJARYZdGVzdGJl
ZC1vcHNAZmx1eC51dGFoLmVkdQIDAs8NMA0GCSqGSIb3DQEBAQUABIGAKeyo7mPO
rHRF2G9t0h8/ALBBh7ChD1zCYvRFi2qvvUIIv/kfCNPhujRfodIYR65dP3tfM+BH
VTRxjJrMYH63m8Fz9KMZlVYn+DhMeiwerqTxvVs823zyxcDrOUzTzzakWmJVSqvl
33Po/7CYZ2iq67ATF1Xym3DsRQbQSuwgzu8wPAYJKoZIhvcNAQcBMB0GCWCGSAFl
AwQBKgQQRw0kmvwhIur/ZlfFbB75qoAQXTKjzwN1HDJW4x5GAcWNPA==
-----END PKCS7-----
    </emulab:password>

which can then be decrypted using the private key to get the plaintext
password.

when there is an error so that we can more easily find it when reviewing
the apt_instance_failures table.

exitcode and the exit message (the one we show to the user). Show the
counts on the dashboard page.

For now, I am not breaking out the errors on the dashboard page. Need
to think about how we break them out, also do we want to show any details
about failures.

the jacks image constraint code is operating nicely.

1. Use information from sliverstatus to indicate that nodes have startup
   execution services running, and then tell then when they have finished,
   and they exited with non-zero status, indicate that they failed. We also
   hold saying the "ready" in the upper panel until all the services have
   exited, we say "booted" instead, and also say that nodes are running
   startup services.

2. For snapshot, when we know an image has to be copied back to its origin
   cluster, tell the web interface, so that we can add another step to the
   imaging modal ("copying"). We know the copy is done when the origin
   cluster has posted the new image data to the IMS, so we do an additional
   poll in the backend waiting for the image server to get the data, and
   then we mark the image as ready for use.