Add Pulsar for interactive tools

README.md

@@ -35,6 +35,7 @@ The component takes the following parameters:
 * `src_galaxy_api_exposed`: Boolean. if `true` (default), the `/api` route does not require authentication via Single Sign-On.
 * `src_ibridges`: Boolean (default: `true`). Whether to enable support for the [iBridges](https://github.com/UtrechtUniversity/galaxy-tools-ibridges) tool for connecting to Yoda and iRODS instances. Implies `src_galaxy_bootstrap`, and adds iBridges to the list of tools to be installed automatically.
 * `src_galaxy_jobs_docker`: Boolean. Enables Galaxy support for running jobs in Docker containers. Any jobs that *can* be run in a docker container will be---jobs that cannot will be run in the default manner (in a `conda` env). Runnings jobs in a container may be slower than running them locally, so consider turning this feature off if not needed.
+* `src_galaxy_pulsar_embedded`: Boolean (default: `true`). Runs any Docker jobs with the 'Pulsar Embedded' runner, which provides better data isolation (without it, [Docker containers have access to the entire data directory](https://training.galaxyproject.org/training-material/topics/admin/tutorials/interactive-tools/tutorial.html#securing-interactive-tools)). However, this causes another performance hit: job data needs to be copied to the container.
 * `src_galaxy_interactive_tools`: if `true` (default), support for [interactive tools](https://docs.galaxyproject.org/en/master/admin/special_topics/interactivetools.html) is enabled. **Note**: this implies *src_galaxy_jobs_docker*, and the accompanying performance hits.
 * `src_galaxy_co_admin_group`: String group corresponding to an SRAM group. Members of this SRAM group will be made Galaxy admin users.
 * `src_galaxy_bootstrap`: if `true` (default), will attempt to install workflows, dataproviders and tools as configured by the following options:

templates/galaxy/config/job_conf.yml.j2

@@ -2,19 +2,28 @@ runners:
   local:
     load: galaxy.jobs.runners.local:LocalJobRunner
     workers: 4
-
+{% if _galaxy_jobs_pulsar_embedded %}
+  pulsar_embedded:
+    load: galaxy.jobs.runners.pulsar:PulsarEmbeddedJobRunner
+    config: {{ galaxy_config_dir }}/pulsar_app.yml
+    workers: 2
+{% endif %}
 execution:
   default: docker_dispatch
   environments:
     local:
       runner: local
 
     docker_local:
-      runner: local
+      runner: {{ 'pulsar_embedded' if _galaxy_jobs_pulsar_embedded else 'local' }}
       docker_enabled: true
       docker_set_user:
       docker_sudo: false
-
+{%    if _galaxy_jobs_pulsar_embedded  %}
+      container_monitor_result: callback
+      env:
+        REQUESTS_CA_BUNDLE: /etc/ssl/certs/ca-certificates.crt
+{%    endif                            %}
     docker_dispatch:
       runner: dynamic
       type: docker_dispatch

vars/src_galaxy_vars.yml

@@ -13,6 +13,7 @@ _galaxy_api_exposed: "{{ src_galaxy_api_exposed | default(true, true) }}"
 _galaxy_use_interactive_tools: "{{ src_galaxy_interactive_tools | default(true, true) | bool }}"
 _galaxy_server_fqdn: "{{ workspace_fqdn | default('localhost', true) }}"
 _galaxy_jobs_docker: "{{ _galaxy_use_interactive_tools or (src_galaxy_jobs_docker | default(true, false) | bool )  }}"
+_galaxy_jobs_pulsar_embedded: "{{ src_galaxy_pulsar_embedded | default(_galaxy_use_interactive_tools, true) | bool }}"
 
 # Build the final lists of tool and workflow installation files
 _galaxy_tool_files: "{{ src_galaxy_tool_files | default('', true) | split(',') | select() + _galaxy_default_tool_files_list }}"  # select() necessary because split on the default '' yields ['']