For workflow step jobs, when users ask for kerberos=True, we are adding a side container to ensure Kerberos support.
For workflow engine orchestration, we don't do that. There is no kerberos=True equivalent setting for the whole workflow.
This is especiallly important for Snakemake that has remote data file support and that may need to access them in order to decide how to run the workflow. (See also #41 which works for public data file locations; this issue would allow the same for restricted data file locations.)
What we should do:
Allow users to set kerberos: true on the top level in reana.yaml similarly to CVMFS. This setting should then be used for both workflow engine pod and job pods.
Add Kerberos side-car to run-reana-batch-... as we are adding it to run-reana-job-...
For workflow step jobs, when users ask for
kerberos=True
, we are adding a side container to ensure Kerberos support.For workflow engine orchestration, we don't do that. There is no
kerberos=True
equivalent setting for the whole workflow.This is especiallly important for Snakemake that has remote data file support and that may need to access them in order to decide how to run the workflow. (See also #41 which works for public data file locations; this issue would allow the same for restricted data file locations.)
What we should do:
kerberos: true
on the top level inreana.yaml
similarly to CVMFS. This setting should then be used for both workflow engine pod and job pods.