Exploitation of network-segregated CPU resources in CMS

CMS is tackling the exploitation of CPU resources at HPC centers where compute nodes do not have network connectivity to the Internet. Pilot agents and payload jobs need to interact with external services from the compute nodes access to the application software (cmvfs) and conditions data (Frontier), management of input and output data files (data management services), and job management (HTCondor). Finding an alternative route to these services is challenging. Seamless integration in the CMS production system without causing any operational overhead is a key goal.We describe in this paper the solutions developed within CMS to overcome the restrictions imposed by network-segregated compute nodes. The Barcelona Supercomputing Center (BSC) in Spain has been used as a testbed for the integration in production of this kind of resource. Singularity containers with application software releases are built and pre-placed in the HPC shared file system together with conditions data files. HTCondor has been extended to relay communications between running pilot jobs and HTCondor daemons through the HPC shared file system. This operation mode also allows piping input and output data files through the HPC file system. Results, issues encountered during the integration process, and remaining concerns are discussed in this report.