Merge branch 'main' into fix/additional-nodes-inventory

Author: sjpb

.github/bin/get-s3-image.sh

@@ -17,7 +17,7 @@ if [ -n "$image_exists" ]; then
 else
     echo "Image $image_name not found in OpenStack. Getting it from S3."
 
-    wget https://object.arcus.openstack.hpc.cam.ac.uk/swift/v1/AUTH_3a06571936a0424bb40bc5c672c4ccb1/$bucket_name/$image_name --progress=dot:giga
+    wget https://leafcloud.store/swift/v1/AUTH_f39848421b2747148400ad8eeae8d536/$bucket_name/$image_name --progress=dot:giga
 
     echo "Uploading image $image_name to OpenStack..."
     openstack image create --file $image_name --disk-format qcow2 $image_name --progress

.github/workflows/fatimage.yml

@@ -31,7 +31,7 @@ jobs:
             source_image_name: Rocky-8-GenericCloud-Base-8.10-20240528.0.x86_64.raw
             inventory_groups: control,compute,login,update
           - image_name: openhpc-RL9
-            source_image_name: Rocky-9-GenericCloud-Base-9.5-20241118.0.x86_64.raw
+            source_image_name: Rocky-9-GenericCloud-Base-9.6-20250531.0.x86_64.qcow2
             inventory_groups: control,compute,login,update
     env:
       ANSIBLE_FORCE_COLOR: True

.github/workflows/release-image.yml

@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@v2
 
       - name: Write s3cmd configuration
-        run: echo "${{ secrets.ARCUS_S3_CFG }}" > ~/.s3cfg
+        run: echo "${{ secrets.LEAFCLOUD_S3_CFG }}" > ~/.s3cfg
 
       - name: Install s3cmd
         run: |

.github/workflows/s3-image-sync.yml

@@ -1,4 +1,4 @@
-name: Upload CI-tested images to Arcus S3 and sync clouds
+name: Upload CI-tested images to Leafcloud S3 and sync clouds
 on:
   workflow_dispatch:
   push:
@@ -21,7 +21,7 @@ jobs:
 
       - name: Write s3cmd configuration
         run: |
-          echo "${{ secrets['ARCUS_S3_CFG'] }}" > ~/.s3cfg
+          echo "${{ secrets['LEAFCLOUD_S3_CFG'] }}" > ~/.s3cfg
         shell: bash
 
       - name: Install s3cmd
@@ -73,7 +73,7 @@ jobs:
 
       - name: Write s3cmd configuration
         run: |
-          echo "${{ secrets['ARCUS_S3_CFG'] }}" > ~/.s3cfg
+          echo "${{ secrets['LEAFCLOUD_S3_CFG'] }}" > ~/.s3cfg
         shell: bash
 
       - name: Install s3cmd and qemu-utils

.github/workflows/upload-release-image.yml.sample

@@ -19,7 +19,7 @@ on:
     inputs:
       image_name:
         type: string
-        description: Image name from: (https://object.arcus.openstack.hpc.cam.ac.uk/swift/v1/AUTH_3a06571936a0424bb40bc5c672c4ccb1/{BUCKET_NAME})
+        description: Image name from: (https://leafcloud.store/swift/v1/AUTH_f39848421b2747148400ad8eeae8d536/{BUCKET_NAME})
         required: true
       bucket_name:
         type: choice

README.md

@@ -61,7 +61,7 @@ Run the following from the repository root to activate the venv:
 Use the `cookiecutter` template to create a new environment to hold your configuration:
 
     cd environments
-    cookiecutter skeleton
+    cookiecutter ../cookiecutter
 
 and follow the prompts to complete the environment name and description.
 

ansible/fatimage.yml

@@ -190,6 +190,11 @@
         tasks_from: install.yml
       when: "'alertmanager' in group_names"
 
+    - name: Download HPL source
+      include_role:
+        name: hpctests
+        tasks_from: source-hpl.yml
+
 - hosts: prometheus
   become: yes
   gather_facts: yes

ansible/roles/alertmanager/README.md

@@ -11,12 +11,9 @@ Note that:
 - No Grafana dashboard for alerts is currently provided.
 
 Alertmanager is enabled by default on the `control` node in the
-[everything](../../../environments/common/layouts/everything) template which
-`cookiecutter` uses for a new environment's `inventory/groups` file.
+`site` environment's `inventory/groups` file.
 
 In general usage may only require:
-- Adding the `control` node into the `alertmanager` group in `environments/site/groups`
-  if upgrading an existing environment.
 - Enabling the Slack integration (see section below).
 - Possibly setting `alertmanager_web_external_url`.
 

ansible/roles/block_devices/README.md

@@ -11,7 +11,7 @@ This is a convenience wrapper around the ansible modules:
 
 To avoid issues with device names changing after e.g. reboots, devices are identified by serial number and mounted by filesystem UUID.
 
-**NB:** This role is ignored[^1] during Packer builds as block devices will not be attached to the Packer build VMs. This role is therefore deprecated and it is suggested that `cloud-init` is used instead. See e.g. `environments/skeleton/{{cookiecutter.environment}}/tofu/control.userdata.tpl`.
+**NB:** This role is ignored[^1] during Packer builds as block devices will not be attached to the Packer build VMs. This role is therefore deprecated and it is suggested that `cloud-init` is used instead. See e.g. `environments/site/tofu/control.userdata.tpl`.
 
 [^1]: See `environments/common/inventory/group_vars/builder/defaults.yml`
 

ansible/roles/freeipa/README.md

@@ -7,7 +7,7 @@ Support FreeIPA in the appliance. In production use it is expected the FreeIPA s
 
 ## Usage
 - Add hosts to the `freeipa_client` group and run (at a minimum) the `ansible/iam.yml` playbook.
-- Host names must match the domain name. By default (using the skeleton OpenTofu) hostnames are of the form `nodename.cluster_name.cluster_domain_suffix` where `cluster_name` and `cluster_domain_suffix` are OpenTofu variables.
+- Host names must match the domain name. By default (using the site OpenTofu) hostnames are of the form `nodename.cluster_name.cluster_domain_suffix` where `cluster_name` and `cluster_domain_suffix` are OpenTofu variables.
 - Hosts discover the FreeIPA server FQDN (and their own domain) from DNS records. If DNS servers are not set this is not set from DHCP, then use the `resolv_conf` role to configure this. For example when using the in-appliance FreeIPA development server:
 
   ```ini
@@ -28,7 +28,7 @@ Support FreeIPA in the appliance. In production use it is expected the FreeIPA s
 - For production use with an external FreeIPA server, a random one-time password (OTP) must be generated when adding hosts to FreeIPA (e.g. using `ipa host-add --random ...`). This password should be set as a hostvar `freeipa_host_password`. Initial host enrolment will use this OTP to enrol the host. After this it becomes irrelevant so it does not need to be committed to git. This approach means the appliance does not require the FreeIPA administrator password.
 - For development use with the in-appliance FreeIPA server, `freeipa_host_password` will be automatically generated in memory.
 - The `control` host must define `appliances_state_dir` (on persistent storage). This is used to back-up keytabs to allow FreeIPA clients to automatically re-enrol after e.g. reimaging. Note that:
-  - This is implemented when using the skeleton OpenTofu; on the control node `appliances_state_dir` defaults to `/var/lib/state` which is mounted from a volume.
+  - This is implemented when using the site OpenTofu; on the control node `appliances_state_dir` defaults to `/var/lib/state` which is mounted from a volume.
   - Nodes are not re-enroled by a [Slurm-driven reimage](../../collections/ansible_collections/stackhpc/slurm_openstack_tools/roles/rebuild/README.md) (as that does not run this role).
   - If both a backed-up keytab and `freeipa_host_password` exist, the former is used.