Operating the Belle II Collaborative Services and Tools
Total Page:16
File Type:pdf, Size:1020Kb
EPJ Web of Conferences 245, 08009 (2020) https://doi.org/10.1051/epjconf/202024508009 CHEP 2019 Operating the Belle II Collaborative Services and Tools Andreas Gellrich1, Daniel Knittel1 , and Thomas Kuhr2 1Deutsches Elektronen-Synchrotron, DESY, Hamburg, Germany 2Ludwig-Maximillians Universität, LMU, Munich, Germany Abstract. In 2016 the Belle II collaboration reviewed and consolidated their collaborative services and tools. Services and tools were migrated into the existing IT infrastructure at DESY. Missing components were added, workflows adapted, and a membership management system was developed. Since the Belle II collaboration was already alive and working, the collaborative work could not be completely started from scratch. The introduction of new technologies - in particular up-to-date security mechanisms - required users to get used to new systems, workflows, and look-and-feels. In this contribution we review the migration process and thoroughly discussed experiences which we gained while supporting the daily work of the Belle II collaboration. 1 Introduction The Belle II experiment at the SuperKEKB e+ e- collider at KEK in Tsukuba, Japan is the successor of the Belle experiment. Belle II started data taking in 2019 and plans to run until the end of this decade, aiming on collecting an integrated luminosit% of &" ab-#. 's of Jul% !"!" the Belle II collaboration consists of more than #""" scientists from (#"" institutions from 23 countries in 4 continents covering 19 time zones. In the first part of this paper we describe the current status of Belle II collaborative services. In the latter part .e summarise experiences gained during the migration process from the initial services and tools hosted at KEK, as .ell as experiences from almost four years of operating the ne. services. 2 Collaborative Services and Tools 2.1 Motivation /ollaborative services and tools are needed to e0cientl% communicate .ithin a global virtual communit% such as Belle II. The% facilitate the sharing and exchange of relevant information among the members as .ell as presenting selected information to the public mainly through web services. © The Authors, published by EDP Sciences. This is an open access article distributed under the terms of the Creative Commons Attribution License 4.0 (http://creativecommons.org/licenses/by/4.0/). EPJ Web of Conferences 245, 08009 (2020) https://doi.org/10.1051/epjconf/202024508009 CHEP 2019 In !"#1 the Belle II collaboration decided to consolidate their collaborative services and tools to meet the requirements for at least a decade of experimental .ork in high ener % particle physics 34E56. 's a result of a thorough revie. all services and tools .ere migrated into the existing IT infrastructure at 7ES8 .hich already supports various experiments and groups such as the European 9:E;, /:E;, and other 4E5 experiments at 7ES8. Most of the services and tools .ere subject to modi-cations and adaptions to meet ne. demands in technology and security. Missing services and tools .ere added or developed. 7etails on the concept and the migration process .ere already presented in a poster session during C4E5 2016 in San Francisco and are available in the proceedings [#?. 2.2 Requirements The following aspects and requirements were identi-ed and considered essential@ Table 1. Requirements to the collaborative services and tools. Requirement Comment The General Data Protection Regulation 3B75A6 of the European Union must be fulfilled. Data and services must be protected against unauthorized access. Security Authentication and authorization for all users according to law. Centrally controlled updates and maintenance. Secured web services use officially issued certificates. Servers run in a dedicated protected subnet. Access is restricted to authenticated users (via account/password). User accounts are managed centrally. Access ' membership management system is the source for all user associated services such as mailing lists and author lists. Legacy Already existing information must be kept. Reliability, Stability, The experiment must be operational and stable at any time. Availability Integrity of data and information is crucial. Minimise the use of self-developed and self-maintained tools. The collaboration will exist for E10 years. Sustainability, Services embedded into a existing IT infrastructure which is used by other Maintainability groups too 3synergy6. Usage of state-of-the art technologies. New requirements demand new features or new services and tools. Flexibility Self-maintained or self-developed services are run on virtual hosts. 2 EPJ Web of Conferences 245, 08009 (2020) https://doi.org/10.1051/epjconf/202024508009 CHEP 2019 2.3 IT-Infrastructure The 7ES8 IT service infrastructure is operated to support the scienti-c computing performed by the various groups at 7ES8. 'mong them are G;/B 4E5 groups, I;/, the European 9:E;, and /:E;. B% .a% of the Atlassian >)? tool suite a portfolio of collaborative services and tools is provided. 'dditional services, in particular small-scale self-maintained or even self-developed tools, are operated in ;inux-based virtual hosts in a dedicated XEN-cluster [*?. Security at DESY 7ata and services must be protected against unauthori,ed access at all times and the Beneral 7ata 5rotection Aegulation 3B75A6 of the European Cnion must be ful-lled. Csers and accounts are managed .ith an Identit% and 'ccess Management 3I'<6 system .hich requires indi+idual credentials 3accountDpassword) to access services at 7ES8. The 7ES8 password policy asks for a rene.al ever% 180 days. 'll server hosts are regularl% scanned for securit% holes such as rootkits and kernel vulnerabilities. Open net.ork ports are regularl% tested and monitored. Network Services J in particular .eb services - .hich allow access form outside 7ES8 are operated in dedicated subnets .ith strict port protection by a -re.all - a so-called de-militari,ed ,one 37<K6. Geb servers are equipped .ith server certi-cates and onl% support secure .eb access (https). Systems Services .hich are maintained and operated by users, such as Belle II users, run in virtual machines in XEN-clusters. :or Belle II ;inux hosts are offered .ith centrally-installed, configured, and maintained operating systems 3Cbuntu, Scienti-c ;inux, /entIS6, running in an D<K. Data Essential -les are stored on distributed -le systems. In addition TSM backup can be configured. IT services 7edicated domain belle2.or and the website . ...belle2.or 7ES8 user registr% (user accounts) Sympa (mailing lists service6 Indic (agenda service6 !MS2 (.ebsite service6 NetApp-based distributed file system 3 EPJ Web of Conferences 245, 08009 (2020) https://doi.org/10.1051/epjconf/202024508009 CHEP 2019 TSM backups Atlassian tool suite #onfluence (.iki6 %IRA (issue tracker6 Stash (git web UI6 'amboo (build system6 Additional services :or services and tools .hich are not part of the 7ES8 portfolio a set up virtual hosts are made available in a XEN-cluster >*?. 'll hosts are operated in a 7<K and are centrall% maintained and updated. TSM backup for crucial data is available. Geb services 3'pache!6 is available .ith 7:F 3(eutsches Forschungs Net) *erein6 certi-cates and access to the registr% 3user accounts) via ;7'5. The actual service is then operated and maintained by a Belle II responsible@ Inveni (documents) electronic logbook (eLog6 shift tool chat service (Roc+et,#hat6 questions (Ask'ot6 monitoring services (Apache"6 soft.are building and validation ('amboo, 'uildBot6 2.4 Membership Management System 7ue to the lack of existing soft.are products a membership management system .as developed for Belle II at DES8 in 2017. It is in production since Januar% 2018. The Belle II Membership Management System 3B2MMS6 plays a central role for the organi,ation and management of the collaboration: It keeps track of all users who are connected to Belle II. It is the source for all Belle II member related issues such as: mailing lists author lists voting shift lists Maintenance & Operation (<NI6 costs 4 EPJ Web of Conferences 245, 08009 (2020) https://doi.org/10.1051/epjconf/202024508009 CHEP 2019 The membership management system implements the following paradigms: It manages all persons .ho have some involvement .ith Belle IIO this includes non-Belle II collaboration members such as externals, summer students etc. .ho need access to the Belle II collaborative services and tools. In order to access the system, 7ES8 login credentials are needed. It acts as an interface to the DES8 registr% to provide credentials (accountDpassword). 5erson data are in general not public. Inl% selected information is presented to the Belle II community. The institutional representatives 3IR6 in the institutional board 3IB6 pla% a crucial role. The% take care of the users of their institution. Authentication of persons are done via Brid user certi-cates or via and identit% check by the responsible IA. Csers can see and edit their personal data. The change of some data, e.g. membership status, requires approval of an authority. Since the membership categor% determines the role in Belle II collaboration .hich in turn effects the M&I costs; it requires the approval of the IA. The registration of ne. persons is handled by approval .orkflows depending on the membership category. The workflows are set up in accordance to the Belle II by-la.s. 'll data including the status can be changed at any time. Csers must register themselves 3by Brid certi-cate or on invitation) because it is mandator% to accept the 7ES8 usage rules. Githout such a permission by the users DES8 is not allowed to store personal data. It is based on the DES8 Identity and Access Management (I'<6 (Apex6 3 Experiences The migration to and introduction of a ne. set of collaborative tools affected both existing, and ne. users. Existing collaborators had to relinquish systems and .orkflows the% had become accustomed to, and .ere asked to adopt ne. ones. In particular colleagues .ho .orked .ith the predecessor experiment Belle, .hich .as mainl% operated at KEK, had to abandon acquired habits.