Globus Compute

repository·main·Indexed 41 days ago

https://github.com/globus/globus-compute

A framework for distributed computing featuring a RabbitMQ-based transport layer. It includes the globus-compute-endpoint CLI for managing the lifecycle of Manager and User Endpoints, including configuration, authentication, and on-boot persistence.

Tokens
50.5K
Snippets
168
Records
226
Agent score
50%

What's inside Globus Compute

  1. What is Globus Compute?

    main

    Globus Compute is a distributed Function as a Service (FaaS) platform designed for flexible, scalable, and high-performance remote function execution. Unlike centralized FaaS, it allows execution on heterogeneous remote computers, including laptops, campus clusters, clouds, and supercomputers.

    The platform consists of two core components:

    1. Globus Compute cloud-hosted service: A reliable and secure interface for registering, sharing, and executing functions. It uses a "fire-and-forget" model, meaning the cloud service manages communication with endpoints to ensure execution and stores results/errors until the user retrieves them.
    2. Globus Compute endpoints: Software installed on target systems (laptops, clusters, etc.) that transforms them into function-serving systems. Endpoints can execute functions locally using multiple processes or on connected resources like batch schedulers or cloud APIs.
  2. Use Gladier to simplify Globus Compute flows

    main

    The Gladier toolkit is designed to accelerate the development of flows using Globus Compute. It provides:

    • Input Validation: Validates inputs before starting a flow.
    • Automatic Re-registration: Re-registers functions automatically when they are modified.
    • Flow Generation: Capabilities to automatically generate flow definitions.
  3. Core functions of the globus-compute-endpoint

    main

    The globus-compute-endpoint provides several primary lifecycle and management functions for deploying and managing endpoints:

    • init: Performs a one-time initialization to set up global options for the deployment site.
    • start: Starts an endpoint by its name. If no valid configuration exists, it provides a default configuration for the user to edit. If the endpoint is configured but not yet registered, it performs the registration.
    • stop: Stops a running endpoint by its name.
    • list: Lists all available endpoints currently known to the system.
  4. Use the Globus Compute Client

    main
    The globus_compute_sdk.Client is the primary interface for interacting with the Globus Compute web services API. It provides low-level access to the service's capabilities. While the Client is the core interface, most users should prefer the higher-level Executor for task execution. For detailed usage patterns and guidance, refer to the client_user_guide.
  5. What is a Globus subscription?

    main

    A Globus subscription is an organization-level plan (purchased by an institution, research group, or company) that provides additional capabilities across the Globus platform. It is not a personal account and applies to all users within that organization.

    For Globus Compute specifically, core functionality—such as using Compute endpoints and submitting tasks—does not require a subscription; it only requires authentication via Globus Auth.

  6. Overview of Globus Compute Endpoint architecture

    main

    A Globus Compute Endpoint acts as a conduit for executing functions on computing resources. It manages site-specific interactions to provide a unified API for running code across diverse environments (laptops, clusters, HPC systems). The architecture consists of three main process types:

    1. Manager endpoint process (MEP): Renders configuration templates to launch and manage user endpoint processes.
    2. User endpoint process (UEP): Establishes secure communication with Globus Compute web services to receive tasks, launch worker processes, and publish results.
    3. Worker process: Executes the actual submitted tasks on target computing resources (e.g., HPC cluster nodes) based on the rendered configuration template.
  7. Compare AWS Lambda and Globus Compute

    main

    If you are transitioning from AWS Lambda to Globus Compute, note these key differences:

    FeatureAWS LambdaGlobus Compute
    PricingUsage-based billingFree (optional subscription available)
    DeploymentCloud-onlyHybrid cloud and on-premises
    Execution EnvironmentManaged by AWSManaged by endpoint administrators
    Function DefinitionPackaged code with handlerPlain Python functions
    DependenciesDeployment packages, layersManaged by endpoint administrators

    In Compute, functions are Python or Bash source code registered with the service. They are not tied to a specific execution context. Instead, users choose an endpoint (the runtime environment) to execute the code. Endpoints are identified by a UUID assigned during registration.

  8. Pass arguments and data to functions

    main

    Globus Compute functions support standard Python *args and **kwargs.

    Constraint: All data passed to or returned from a function must be serializable (e.g., via Pickle) and must stay within the service's size and rate limits.

    def hello(firstname, lastname):
        """Say hello to someone."""
        return 'Hello {} {}'.format(firstname, lastname)
    
    func_id = gcc.register_function(hello)
    task_id = gcc.run("Bob", "Smith", endpoint_id=tutorial_endpoint, function_id=func_id)
    
    try:
        print(gcc.get_result(task_id))
    except Exception as e:
        print("Exception: {}".format(e))
  9. High-Assurance (HA) subscription benefits

    main

    High-Assurance (HA) subscriptions are designed for organizations handling sensitive data (e.g., PHI, PII, or CUI) and provide enhanced security protocols. When associated with a HA subscription, Globus Compute implements:

    • HA policies: Policies requiring extra authentication, such as specific identity requirements, periodic re-authentication, or multi-factor authentication (MFA).
    • HA functions: Specialized functions that may only be used by specific HA endpoints. These functions are removed after 3 months of inactivity. SDK access to these functions is governed by the associated HA policy.
    • Audit logging: Logging of task events (e.g., task start/completion, user identity, etc.).
    • Security assertions: In-code assertions that verify endpoint settings (such as encryption) are secure.

    Note: While HA policies require an HA-enabled subscription, standard (non-HA) policies do not require any subscription.

  10. Customize the User Endpoint Process with user_config_template.yaml.j2

    main

    The MEP renders user_config_template.yaml.j2 as a Jinja template to launch the UEP. The default template includes a worker_init script that manages the Python environment for each worker.

    You can provide two specific user-defined variables to this template:

    • requirements: A string declaring the Python packages required for the environment.
    • worker_init: Custom shell logic for configuring a worker node.

    Note: The default LocalProvider only uses processes on the endpoint host. For HPC environments, you must customize the template to use a provider that can access compute nodes.

    # user_config_template.yaml.j2 snippet
    endpoint_setup: {{ endpoint_setup|default() }}
    
    engine:
       type: GlobusComputeEngine
       max_workers_per_node: 1
    
       provider:
          type: LocalProvider
          min_blocks: 0
          max_blocks: 1
          init_blocks: 1
    
          worker_init: |
             # installs `requirements` and runs the user's `worker_init`
             ...
    
    idle_heartbeats_soft: 10
    idle_heartbeats_hard: 5760
  11. Secure a Multi-User Compute Endpoint using Identity Mapping

    main

    Multi-user Compute Endpoints (running as root) use Identity Mapping to translate a Globus Auth identity set into a local POSIX user account. This allows the endpoint to use the standard Unix fork() -> drop privileges -> exec() workflow, ensuring that task processing is performed under the permissions of the specific local user. This enables standard Unix administrative user controls to be enforced on the endpoint host.

    For multi-user endpoints, an identity mapping configuration is required to perform this translation. Refer to the configuration documentation for specific mapping examples.

  12. Access reserved variables via _GC in templates

    main

    Globus Compute templates have access to a set of reserved variables that cannot be overridden by users or administrators. These are accessed through the _GC object.

    Note: While parent_config, user_runtime, and mapped_identity are available as top-level variables for legacy reasons, using the _GC prefix is the recommended approach and top-level access is deprecated.

    Key reserved variables include:

    • _GC.parent_config: Configuration values of the parent manager endpoint.
    • _GC.env: Environment variables available to the user's runtime (e.g., _GC.env.HOME).
    • _GC.user_runtime: Information about the user's Python and platform environment.
    • _GC.mapped_identity: Information about the user's mapped identity (UID, GID, groups, etc.).