PUNCH4NFDI Deliverable Report - Demonstrator for a Federated Compute Infrastructure

A detailed description of the federated compute infrastructure made available to the PUNCH4NDFI consortium, Compute4PUNCH, is provided. The federation of the available compute resources is based on a single overlay batch system defining a single pool of resources whose provisioning is ensured by a metascheduler. This is realised by using the HTCondor batch system, the COBalD/TARDIS meta-scheduler and the Apptainer container technology. The provisioning of entry points is based on traditional login nodes running the HTCondor suite and enabling the users to submit jobs to the Compute4PUNCH infrastructure. The access to the entry points is standardised using access tokens based on the OIDC protocol and provisioned by the Helmholtz AAI provider. The scalable provisioning of the workflow-specific software environments is based on the Apptainer container technology and the use of the CERN Virtual Machine File System CVMFS from which the workflow-specific containers are retrieved when the HTCondor jobs are executed. The refreshment of access tokens required to access the storage resources of the PUNCH4NFDI consortium is based on the Mytoken service that delivers credential artifacts allowing to refresh access tokens without resorting to the users. The implementation in the HTCondor suite makes use of a producer and a monitoring plugins taking care of the OIDC flow in a way transparent to the users. In addition to the description of the demonstrator, this report also describes some additional developments, namely the integration of additional compute resources into the Compute4PUNCH infrastructure, the development of user workflows and the integration of the access token-based HTCondor software suite in the REANA analysis platform in collaboration with the TA4 WP4 working group responsible for the development of the PUNCH4NFDI Data Portal.