Merging in new changes from main and rebuilding image

stackhpc · Aug 17, 2023 · 6a1af7b · 6a1af7b
2 parents 5d4d408 + def4a77
commit 6a1af7b
Show file tree

Hide file tree

Showing 15 changed files with 145 additions and 61 deletions.
diff --git a/generate-secrets.sh b/generate-secrets.sh
diff --git a/image/Dockerfile b/image/Dockerfile
@@ -9,6 +9,8 @@ LABEL org.opencontainers.image.source="https://github.com/stackhpc/slurm-docker-
 ARG SLURM_TAG=slurm-23.02
 ARG GOSU_VERSION=1.11
 
+COPY kubernetes.repo /etc/yum.repos.d/kubernetes.repo
+
 RUN set -ex \
     && yum makecache \
     && yum -y update \
@@ -46,6 +48,7 @@ RUN set -ex \
        openssh-server \
        apptainer \
        ondemand \
+       kubectl \
     && yum clean all \
     && rm -rf /var/cache/yum
 

diff --git a/image/docker-entrypoint.sh b/image/docker-entrypoint.sh
@@ -156,6 +156,18 @@ then
             exit 1
     fi
 
+elif [ "$1" = "generate-keys-hook" ]
+then
+    mkdir -p ./temphostkeys/etc/ssh
+    ssh-keygen -A -f ./temphostkeys
+    kubectl create secret generic host-keys-secret \
+    --dry-run=client \
+    --from-file=./temphostkeys/etc/ssh \
+    -o yaml | \
+    kubectl apply -f -
+
+    exit 0
+
 elif [ "$1" = "debug" ]
 then
     start_munge --foreground

diff --git a/image/kubernetes.repo b/image/kubernetes.repo
@@ -0,0 +1,6 @@
+[kubernetes]
+name=Kubernetes
+baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-$basearch
+enabled=1
+gpgcheck=1
+gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
diff --git a/slurm-cluster-chart/templates/database-auth-secret.yaml b/slurm-cluster-chart/templates/database-auth-secret.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: database-auth-secret
+  annotations:
+    helm.sh/hook: pre-install
+data:
+  password: {{ randAlphaNum 32 | b64enc }}
diff --git a/slurm-cluster-chart/templates/generate-keys-hook.yaml b/slurm-cluster-chart/templates/generate-keys-hook.yaml
@@ -0,0 +1,22 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: generate-keys-hook
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-delete-policy": hook-succeeded
+    "helm.sh/hook-weight": "3"
+spec:
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 0
+  template:
+    metadata:
+      name: generate-keys-hook
+    spec:
+      serviceAccountName: secret-generator-account
+      restartPolicy: Never
+      containers:
+      - name: generate-keys-hook
+        image: {{ .Values.slurmImage }}
+        args:
+          - generate-keys-hook
diff --git a/slurm-cluster-chart/templates/helm-authorized-keys-configmap.yaml b/slurm-cluster-chart/templates/helm-authorized-keys-configmap.yaml
@@ -0,0 +1,9 @@
+#Only applied if sshPublicKey provided in values.yaml, if not assumes you have run publish-keys.sh prior to helm release
+{{ if .Values.sshPublicKey }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: helm-authorized-keys-configmap
+data:
+  authorized_keys: {{ .Values.sshPublicKey }}
+{{ end }}
diff --git a/slurm-cluster-chart/templates/login.yaml b/slurm-cluster-chart/templates/login.yaml
@@ -28,10 +28,7 @@ spec:
           name: login
           env:
             - name: ROCKY_OOD_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: htdbm-secret
-                  key: password
+              value: {{ .Values.openOnDemand.password }}
             - name: JUPYTER_REPO
               value: {{ .Values.jupyterApp.repoURL }}
             - name: JUPYTER_TAG
@@ -87,7 +84,11 @@ spec:
             defaultMode: 0400
         - name: authorized-keys
           configMap:
-            name: {{ .Values.configmaps.authorizedKeys }}
+            {{ if .Values.sshPublicKey }}
+            name: helm-authorized-keys-configmap
+            {{ else }}
+            name: authorized-keys-configmap
+            {{ end }}
         - name: cluster-config
           configMap:
             name: cluster-config

diff --git a/slurm-cluster-chart/templates/munge-key-secret.yaml b/slurm-cluster-chart/templates/munge-key-secret.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: munge-key-secret
+  annotations:
+    helm.sh/hook: pre-install
+data:
+  munge.key: {{ randAscii 128 | b64enc }}
diff --git a/slurm-cluster-chart/templates/mysql-deployment.yaml b/slurm-cluster-chart/templates/mysql-deployment.yaml
@@ -34,7 +34,7 @@ spec:
               value: "yes"
             - name: MYSQL_USER
               value: "slurm"
-          image: {{ .Values.sqlImage }}
+          image: {{ .Values.database.image }}
           name: mysql
           ports:
             - containerPort: 3306

diff --git a/slurm-cluster-chart/templates/secret-generator-role.yaml b/slurm-cluster-chart/templates/secret-generator-role.yaml
@@ -0,0 +1,28 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: secret-generator-role
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "1"
+rules:
+- apiGroups: [""] # "" indicates the core API group
+  resources: ["secrets"]
+  verbs: ["get","apply","create", "patch"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: secret-generator-rolebinding
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "2"
+subjects:
+  - kind: ServiceAccount
+    name: secret-generator-account
+roleRef:
+  kind: Role
+  name: secret-generator-role
+  apiGroup: rbac.authorization.k8s.io
diff --git a/slurm-cluster-chart/templates/secret-generator-serviceaccount.yaml b/slurm-cluster-chart/templates/secret-generator-serviceaccount.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: secret-generator-account
+  annotations:
+    "kubernetes.io/enforce-mountable-secrets": "true"
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "0"
+automountServiceAccountToken: True
+secrets:
+  - name: host-keys-secret
diff --git a/slurm-cluster-chart/templates/slurmd.yaml b/slurm-cluster-chart/templates/slurmd.yaml
@@ -20,24 +20,23 @@ spec:
         app.kubernetes.io/name: slurm
         app.kubernetes.io/component: slurmd
     spec:
-      topologySpreadConstraints:
-        - maxSkew: 1
-          whenUnsatisfiable: ScheduleAnyway
-          topologyKey: kubernetes.io/hostname
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: slurm
-              app.kubernetes.io/component: slurmd
       containers:
         - args:
             - slurmd
             - -F
             - -vvv
+            - -N
+            - "$(POD_NAME)"
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
           image: {{ .Values.slurmImage }}
           name: slurmd
           ports:
-            - containerPort: 6818
             - containerPort: 8888
+            - hostPort: 6818
           resources: {}
           volumeMounts:
             - mountPath: /etc/slurm/
@@ -49,6 +48,8 @@ spec:
               subPath: munge.key
           securityContext:
             privileged: true
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
       dnsConfig:
         searches:
           - slurmd.{{ .Release.Namespace }}.svc.cluster.local

diff --git a/slurm-cluster-chart/templates/var-lib-mysql-persistentvolumeclaim.yaml b/slurm-cluster-chart/templates/var-lib-mysql-persistentvolumeclaim.yaml
@@ -11,4 +11,4 @@ spec:
     - ReadWriteOnce
   resources:
     requests:
-      storage: {{ .Values.databaseStorage }}
+      storage: {{ .Values.database.storage }}
diff --git a/slurm-cluster-chart/values.yaml b/slurm-cluster-chart/values.yaml
@@ -53,20 +53,34 @@ rooknfs:
 
 
 
-sqlImage: mariadb:10.10
-
-databaseStorage: 100Mi
+# Values for Slurm's database container
+database:
+  #Database image to be used
+  image: mariadb:10.10
+  #Storage requested by the var-lib-mysql volume backing the database
+  storage: 100Mi
 
+# Configmap resource names
 configmaps:
-  authorizedKeys: authorized-keys-configmap
   slurmConf: slurm-conf-configmap
   slurmdbdConf: slurmdbd-conf-configmap
   sshdConfig: sshd-config-configmap
 
+# Public key used for ssh access to the login node
+# If let undefined, assumes you have run the provided publish-keys.sh script to publish your public key prior to deployment
+sshPublicKey:
+
+# Secret resource names
 secrets:
-  databaseAuth: database-auth-secret
   mungeKey: munge-key-secret
+<<<<<<< HEAD
 
 jupyterApp:
   repoURL: "https://github.com/stackhpc/OOD-containerised-jupyter.git"
-  repoTag: "v0.1"
+  repoTag: "v0.1"
+=======
+
+openOnDemand:
+  #Password for default Open OnDemand user 'rocky'
+  password: password
+>>>>>>> main