Cloudera Docs

Impact of Upgrades on Draft Workflows & Deployment

Tool Sandboxing in Agent Studio Upgrades

Following the upgrade of Agent Studio to incorporate tool sandboxing, the following conditions take effect:

  • New and Draft Workflows: Tool sandboxing is automatically enabled for all new workflows and draft workflows. All tool executions for these workflows shall run within isolated, sandboxed environments.
  • Existing Deployed Workflows: Tool sandboxing does not automatically apply to workflows that are already deployed. This measure is implemented to ensure the uninterrupted functionality of currently deployed production workflows.

Migrating Deployed Workflows to Use Sandboxing

The following steps are required to enable tool sandboxing on a currently deployed workflow:
  1. Review Tool Executions:
    • Open the deployed workflow in Agent Studio
    • Review all tools in the workflow to identify any that may need updates
    • Specific checks for tools include:
      • Data Access: Tools accessing data connections must include the cdsw_api_v2_key parameter.
      • Reading Files: Tools reading files from CML project paths must use the workflow_data directory only.
      • Writing Files: Tools writing files to project directories must direct output to the designated session directory.
  2. Update Tool Code: The following steps are required for tool migration and adaptation:
    • Follow the migration instructions provided within this document.
    • Modify the existing tool code to ensure compatibility with sandboxed execution environments.
    • Incorporate the cdsw_api_v2_key parameter where necessary for secure access.
    • Adjust file paths to utilize the designated environment variables: WORKFLOW_DATA_DIRECTORY and SESSION_DIRECTORY.
    • Create config.json files as needed to specify custom mount points or environment variables.
  3. Test the Workflow:
    • Workflow Validation (Draft Mode): Execute the workflow in draft mode to confirm all tools function as intended.
    • Authentication Check: Verify data connections are successful using the new authentication method.
    • I/O Confirmation: Ensure file reading and writing operations execute correctly.
    • Configuration Test: Test any necessary custom mounts and environment variables.
  4. Redeploy the Workflow: After testing is complete, redeploy the workflow. The redeployment automatically enforceS tool sandboxing for all subsequent tool executions. Carefully monitor the initial executions to confirm correct operation.