Seqera Platform Feature Requests

Anonymous

Feature requests for the Seqera Platform (https://cloud.seqera.io)
Nextflow / Fusion needs a "stage in method" to optionally copy the full input file locally
We have been using Fusion for a while now and overall its fantastic. However, it seems like one of the more common edge-cases we ended up debugging is for tasks and processes that are reading or writing data to/from disk at incredibly high rates. In these cases, the data IO speed seems like it can sometimes degrade when Fusion is in use, and one of the "work arounds" can sometimes end up being to try to force the Nextflow task to manually download the entire S3 file locally first, so that the scripts and tools used in the Nextflow task can take advantage of the full speed of the local NVMe cache without the overhead of streaming data in from S3 in the background. This goes against the core purpose of Fusion, and I know the Fusion dev team is working to deal with these situations better, but it also makes me wonder if its worth having some sort of "stage in method" for Fusion (possibly configured from the Nextflow script?) in order to indicate that some specific input files should just automatically get fully downloaded ahead of time in the background by Fusion instead of trying to stream them in as normal. I know this would surface other issues, such as the NVMe cache potentially filling up, so I am not sure if this is an ideal solution to the problem. However at least for debugging, it would actually be very helpful to be able to easily enable a feature like this. Let me know what you guys think. Maybe some alternatives that keep Fusion's core functionality better, might be the ability to ensure that it is pre-cache'ing larger chunks of data than might be the default setting.
1
·
Storage
·
acknowledged
Support customer-managed KMS keys (CMK) for AWS Secrets Manager pipeline secrets
When Platform launches a run on an AWS Batch compute environment, it creates a temporary AWS Secrets Manager secret for each selected workspace or user secret and removes it when the run completes. These secrets are created with the default AWS-managed key, and there is currently no option to have Platform encrypt them with a customer-managed KMS key (CMK). This prevents workspace secrets from working in any AWS account that enforces CMK encryption on Secrets Manager. We have hit this at an enterprise customer whose account runs an automated governance policy that deletes any secret not encrypted with a CMK. The policy removes Platform's secret within seconds of it being created, before the Nextflow head job reads it, so every run that uses a secret fails with Unable to find a secret with name '<x>' — with no indication that the secret was created and then deleted by a third party. The request is to add an option to specify a customer-managed KMS key for these secrets, applied at creation time (the KmsKeyId parameter of the Secrets Manager CreateSecret API). A per-compute-environment setting fits best, since the key is account- and region-specific, with an optional global default. The equivalent capability for GCP Secret Manager would be valuable too. The compute roles that read these secrets already require kms:Decrypt, so no read-path changes should be needed. The only current workaround is for the customer to exempt Platform's secret name prefix (tower-*) from their CMK-enforcement policy. Security teams in regulated environments often will not grant that exemption, which leaves affected customers unable to use workspace secrets on AWS at all.
1
·
Pipelines/Workflows
·
acknowledged
Load More