Merge pull request #24 from stackhpc/azimuth-helm

Moved secret generation from scripts to helm

image/Dockerfile

@@ -9,6 +9,8 @@ LABEL org.opencontainers.image.source="https://github.com/stackhpc/slurm-docker-
 ARG SLURM_TAG=slurm-23.02
 ARG GOSU_VERSION=1.11
 
+COPY kubernetes.repo /etc/yum.repos.d/kubernetes.repo
+
 RUN set -ex \
     && yum makecache \
     && yum -y update \
@@ -46,6 +48,7 @@ RUN set -ex \
        openssh-server \
        apptainer \
        ondemand \
+       kubectl \
     && yum clean all \
     && rm -rf /var/cache/yum
 

image/docker-entrypoint.sh

@@ -150,6 +150,18 @@ then
             exit 1
     fi
 
+elif [ "$1" = "generate-keys-hook" ]
+then
+    mkdir -p ./temphostkeys/etc/ssh
+    ssh-keygen -A -f ./temphostkeys
+    kubectl create secret generic host-keys-secret \
+    --dry-run=client \
+    --from-file=./temphostkeys/etc/ssh \
+    -o yaml | \
+    kubectl apply -f -
+
+    exit 0
+
 elif [ "$1" = "debug" ]
 then
     start_munge --foreground

image/kubernetes.repo

@@ -0,0 +1,6 @@
+[kubernetes]
+name=Kubernetes
+baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-$basearch
+enabled=1
+gpgcheck=1
+gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg

slurm-cluster-chart/templates/database-auth-secret.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: database-auth-secret
+  annotations:
+    helm.sh/hook: pre-install
+data:
+  password: {{ randAlphaNum 32 | b64enc }}

slurm-cluster-chart/templates/generate-keys-hook.yaml

@@ -0,0 +1,22 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: generate-keys-hook
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-delete-policy": hook-succeeded
+    "helm.sh/hook-weight": "3"
+spec:
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 0
+  template:
+    metadata:
+      name: generate-keys-hook
+    spec:
+      serviceAccountName: secret-generator-account
+      restartPolicy: Never
+      containers:
+      - name: generate-keys-hook
+        image: {{ .Values.slurmImage }}
+        args:
+          - generate-keys-hook

slurm-cluster-chart/templates/helm-authorized-keys-configmap.yaml

@@ -0,0 +1,9 @@
+#Only applied if sshPublicKey provided in values.yaml, if not assumes you have run publish-keys.sh prior to helm release
+{{ if .Values.sshPublicKey }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: helm-authorized-keys-configmap
+data:
+  authorized_keys: {{ .Values.sshPublicKey }}
+{{ end }}

slurm-cluster-chart/templates/login.yaml

@@ -28,10 +28,7 @@ spec:
           name: login
           env:
             - name: ROCKY_OOD_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: htdbm-secret
-                  key: password
+              value: {{ .Values.openOnDemand.password }}
           ports:
             - containerPort: 22
             - containerPort: 80
@@ -83,7 +80,11 @@ spec:
             defaultMode: 0400
         - name: authorized-keys
           configMap:
-            name: {{ .Values.configmaps.authorizedKeys }}
+            {{ if .Values.sshPublicKey }}
+            name: helm-authorized-keys-configmap
+            {{ else }}
+            name: authorized-keys-configmap
+            {{ end }}
         - name: cluster-config
           configMap:
             name: cluster-config

slurm-cluster-chart/templates/munge-key-secret.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: munge-key-secret
+  annotations:
+    helm.sh/hook: pre-install
+data:
+  munge.key: {{ randAscii 128 | b64enc }}

slurm-cluster-chart/templates/mysql-deployment.yaml

@@ -34,7 +34,7 @@ spec:
               value: "yes"
             - name: MYSQL_USER
               value: "slurm"
-          image: {{ .Values.sqlImage }}
+          image: {{ .Values.database.image }}
           name: mysql
           ports:
             - containerPort: 3306

slurm-cluster-chart/templates/secret-generator-role.yaml

@@ -0,0 +1,28 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: secret-generator-role
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "1"
+rules:
+- apiGroups: [""] # "" indicates the core API group
+  resources: ["secrets"]
+  verbs: ["get","apply","create", "patch"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: secret-generator-rolebinding
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "2"
+subjects:
+  - kind: ServiceAccount
+    name: secret-generator-account
+roleRef:
+  kind: Role
+  name: secret-generator-role
+  apiGroup: rbac.authorization.k8s.io

slurm-cluster-chart/templates/secret-generator-serviceaccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: secret-generator-account
+  annotations:
+    "kubernetes.io/enforce-mountable-secrets": "true"
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "0"
+automountServiceAccountToken: True
+secrets:
+  - name: host-keys-secret

slurm-cluster-chart/templates/var-lib-mysql-persistentvolumeclaim.yaml

@@ -11,4 +11,4 @@ spec:
     - ReadWriteOnce
   resources:
     requests:
-      storage: {{ .Values.databaseStorage }}
+      storage: {{ .Values.database.storage }}

slurm-cluster-chart/values.yaml

@@ -1,4 +1,4 @@
-slurmImage: ghcr.io/stackhpc/slurm-docker-cluster:7c0e2d9
+slurmImage: ghcr.io/stackhpc/slurm-docker-cluster:d3daba4
 
 login:
   # Deployment resource name
@@ -53,17 +53,27 @@ rooknfs:
 
 
 
-sqlImage: mariadb:10.10
-
-databaseStorage: 100Mi
+# Values for Slurm's database container
+database:
+  #Database image to be used
+  image: mariadb:10.10
+  #Storage requested by the var-lib-mysql volume backing the database
+  storage: 100Mi
 
+# Configmap resource names
 configmaps:
-  authorizedKeys: authorized-keys-configmap
   slurmConf: slurm-conf-configmap
   slurmdbdConf: slurmdbd-conf-configmap
   sshdConfig: sshd-config-configmap
 
+# Public key used for ssh access to the login node
+# If let undefined, assumes you have run the provided publish-keys.sh script to publish your public key prior to deployment
+sshPublicKey:
+
+# Secret resource names
 secrets:
-  databaseAuth: database-auth-secret
   mungeKey: munge-key-secret
-
+
+openOnDemand:
+  #Password for default Open OnDemand user 'rocky'
+  password: password