{section: Condor in the Cloud Seed Construction}

The following is internal documentation.

----

(Instructions assume root.)

*: Start the standard RHEL7.6 image.
*: Install wget.  {term}yum install wget{endterm}
*: Follow the instructions {link: http://research.cs.wisc.edu/htcondor/instructions/el/7/development/ here}.
*: Grab the condor-annex-ec2 script: {term}yum install condor-annex-ec2{endterm}
*: Install the AWS CLI tool needed by that script:
{term}
$ yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
$ yum install pip
$ pip install --upgrade pip
$ pip install awscli
{endterm}
*: Configure HTCondor:
{file: /etc/condor/config.d/local}
# Make this a single-node pool.
DAEMON_LIST = MASTER COLLECTOR SCHEDD STARTD NEGOTIATOR

# Taken from the manual's instructions on installing a minicondor.
# ------------------------------------------------------------------------------

NETWORK_INTERFACE = *
CONDOR_HOST = $(FULL_HOSTNAME)

SEC_DAEMON_INTEGRITY = REQUIRED
SEC_DAEMON_AUTHENTICATION = REQUIRED
SEC_DAEMON_AUTHENTICATION_METHODS = PASSWORD
SEC_NEGOTIATOR_INTEGRITY = REQUIRED
SEC_NEGOTIATOR_AUTHENTICATION = REQUIRED
SEC_NEGOTIATOR_AUTHENTICATION_METHODS = PASSWORD
SEC_CLIENT_AUTHENTICATION_METHODS = FS, PASSWORD
ALLOW_DAEMON = condor_pool@*

# ------------------------------------------------------------------------------
# The following is different from the instructions because the RHEL7 RPM
# sets $(LOCAL_DIR) in a deeply unfortunate way.
SEC_PASSWORD_FILE = /etc/condor/condor_pool_password

# Configure the pool to be externally accessible.  While this isn't necessary
# for the proper functioning of an AWS-only pool, condor_annex can't verify
# the accessibility of this host if it's not externally available, and there's
# not presently an option to disable that check.
#
# Note that EC2PublicIP is set by the condor-annex-ec2 package.
TCP_FORWARDING_HOST = $(EC2PublicIP)
COLLECTOR_HOST = $(TCP_FORWARDING_HOST):9618
ALLOW_WRITE = $(ALLOW_WRITE) $(TCP_FORWARDING_HOST)
ALLOW_NEGOTIATOR = $(ALLOW_NEGOTIATOR) $(TCP_FORWARDING_HOST)
{endfile}
*: Fix the condor-annex-ec2 service file by copying the =After=...= line from the =[Unit]= section of =/usr/lib/systemd/system/condor.service= to =[Unit]= section of =/usr/lib/systemd/system/condor-annex-ec2.service=.
*: Enable the condor-annex-ec2 service.  (For systemd: {term}systemctl enable condor-annex-ec2{endterm}.)
*: {term}rm /etc/condor/50ec2.config{endterm}
*: Edit =/usr/libexec/condor/condor-annex-ec2= so that it _only_ sets =EC2PublicIP= and =EC2InstanceID=: remove from after the "Annex-specific code begins here" comment (line 103) all the way down to =echo "done." (line 252); leave that line but remove next line and change the return to return 0.
*: Run {term}condor_store_cred -c add -f `condor_config_val SEC_PASSWORD_FILE`{endterm} as root to create the pool password file.  Make sure the password file is owned by root and has 600 permissions afterwards.
*: Then copy the pool password file to =~ec2-user/.condor= and chown it to that user; then edit =~ec2-user/.condor/user_config= to point to it; this allows =condor_annex= to copy the pool password file to the new instances.