...
To use gquery from a Slurm job it is necessary to have acquired the Kerberos ticket and module loaded gquery on the login node first.
Kerberos ticket expiry
The Kerberos tickets which is needed for database access are issued by AgResearch Active Directory, and have an expiry time of 10 hours, after which a new ticket must be requested, using kinit
The current tickets can be seen with klist
| Code Block |
|---|
it23677> kinit
it23677> klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: guestsi@AGRESEARCH.CO.NZ
Valid starting Expires Service principal
08/14/2024 08:48:56 08/14/2024 18:48:56 krbtgt/AGRESEARCH.CO.NZ@AGRESEARCH.CO.NZ
renew until 08/14/2024 18:48:56 |
Note the 10 hour expiry time visible here.
If 10 hour expiry turns out to be a problem for long-running jobs, the ticket expiry times for tickets issued by Active Directory will need to be increased.
Explanation
Historically on legacy HPC, database credentials were stored in the filesystem, and users were probably oblivious to the fact that they were being fetched on their behalf to authenticate with the database.
...