Install CentOS9 Stream

WARNING: This page is obsolete.

Not recommended. Please migrate to AlmaLinux9. See CERN Recommendations.

Required packages Not Tested

You will need system privileges for this. Install CentOS9 Stream on your computer; you can choose any packages or versions you like but make sure that the following are also installed:

• Install the CentOS9 Stream desktop version.
• Install the HEP_OSlibs metarpm; see Instructions
  • for x86_64:

yum install https://linuxsoft.cern.ch/wlcg/el9/x86_64/wlcg-repo-1.0.0-1.el9.noarch.rpm 
yum install HEP_OSlibs

• • for aarch64:

yum install https://linuxsoft.cern.ch/wlcg/el9/aarch64/wlcg-repo-1.0.0-1.el9.noarch.rpm
yum install HEP_OSlibs

• Install cvmfs; see Instructions

rpm --import https://cvmrepo.web.cern.ch/cvmrepo/yum/RPM-GPG-KEY-CernVM
yum install https://ecsft.cern.ch/dist/cvmfs/cvmfs-release/cvmfs-release-latest.noarch.rpm
yum install cvmfs
#you may need to enable " user_allow_other" in /etc/fuse.conf before restarting autofs. (and after configuring /etc/cvmfs/default.local)

• Enable user namespace so that Singularity or Apptainer can be used from cvmfs in unprivileged mode.

      echo "user.max_user_namespaces = 15000"  > /etc/sysctl.d/90-max_user_namespaces.conf
      sysctl -p /etc/sysctl.d/90-max_user_namespaces.conf

• • • check as a normal user that setupATLAS -c centos7 works (ie Singularity or Apptainer containers run).

• other rpms needed:

Kerberos Configuration. Not Tested

Example, this is what it should look like with the CERN.CH configurations in /etc/krb5.conf

$ cat  /etc/krb5.conf
# To opt out of the system crypto-policies configuration of krb5, remove the
# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
includedir /etc/krb5.conf.d/

[logging]
    default = FILE:/var/log/krb5libs.log
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmind.log

[libdefaults]
    dns_lookup_realm = false
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    rdns = false
    pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
    spake_preauth_groups = edwards25519
#    default_realm = EXAMPLE.COM
    default_realm = CERN.CH
    default_ccache_name = KEYRING:persistent:%{uid}

[realms]
# EXAMPLE.COM = {
#     kdc = kerberos.example.com
#     admin_server = kerberos.example.com
# }
  CERN.CH = {
    default_domain = cern.ch
    kpasswd_server = afskrb5m.cern.ch
    admin_server = afskrb5m.cern.ch
    kdc = cerndc.cern.ch
  }

[domain_realm]
# .example.com = EXAMPLE.COM
# example.com = EXAMPLE.COM

Test Status

Name	Native Version	aarch64	x86_64	Comments	To be done
container setups
acm					release not available for acm tests
asetup					centos9 arch ATLAS release unavailable
atlantis
eiclient				EIClient is not working outside cern.ch so it is not fully supported.
emi
ganga				Obsolete ?
lcgenv					legenv release unavailable for centos9s aarch64
panda
pyami
root					root release unavailable for centos9s aarch64
rucio
views					release unavailable for centos9s aarch64
xcache					root release unavailable for centos9s aarch64 to test
xrootd					root release unavailable for centos9s aarch64 to test
advancedTools adctools
advancedTools art					can set up, someone needs to test
advancedTools clang					no centos8 or centos9 versions available
advancedTools cmake
advancedTools cppcheck					no centos8 or centos9 versions available
advancedTools davix
advancedTools dcube					unavailable for centos9s
advancedTools gcc				Obsolete
advancedTools git
advancedTools gitlab					can set up and run, someone needs to test
advancedTools hdf5					no centos8 or centos9 versions available
advancedTools logstash
advancedTools prmon
advancedTools python
advancedTools stomp
diagnostics checkOS
diagnostics db-fnget
diagnostics db-readReal				Obsolete
diagnostics gridCert
diagnostics rseCheck
diagnostics runKV				Obsolete
diagnostics setMeUp					no tutorials for centos9 yet
diagnostics setMeUpData				Obsolete
diagnostics supportInfo
diagnostics toolTest
helpMe
printMenu
showVersions

Known Issues

Name	Date	Comments	Resolved ?
centos9s containers	02Aug2022	needs bind-utils, hostname, java-11-openjdk and openldap rpms	11Aug2022: Fixed.
ROOT outside lxplus	02Aug2022	root direct i/o fails because libXrdSeckrb5-5.so is missing in LCG_102. https://sft.its.cern.ch/jira/browse/SPI-2203	16Nov2022: Fixed in LCG_102b
centos9 and xrootd	01Sep2022	clients (eg xrdcp) fail for DDM sites with xrootd older than 5.4.3 and certificates with SHA1 hash algorithm. Temporary solution is to use a centos7 or centos8 container for rucio until this is addressed at all grid sites.	being discussed in WLCG and ADC