refactored ark role, disabled repos at end of build and modified site to work with disabled repos

Author: wtripp180901

ansible/.gitignore

@@ -64,5 +64,5 @@ roles/*
 !roles/k9s/**
 !roles/lustre/
 !roles/lustre/**
-!roles/release_train/
-!roles/release_train/**
+!roles/dnf_repos/
+!roles/dnf_repos/**

ansible/fatimage.yml

@@ -69,6 +69,10 @@
         tasks_from: install.yml
       when: "'openhpc' in group_names"
 
+    - name: Install Apache PAM module # Extracted from start of roles/openondemand/tasks/pam_auth.yml to ensure only installed during build
+      yum:
+        name: mod_authnz_pam
+
     # - import_playbook: portal.yml
     - name: Open Ondemand server (packages)
       include_role:

ansible/roles/dnf_repos/defaults/main.yml

@@ -0,0 +1,24 @@
+dnf_repos_rocky_ark_prefix: https://ark.stackhpc.com/pulp/content/{{ ansible_distribution | lower }}/9.4
+dnf_repos_rocky_ark_suffix: "{{ ansible_architecture }}/os/{{ dnf_repos_ark_timestamp }}/"
+# most stable from https://github.com/stackhpc/stackhpc-kayobe-config/blob/stackhpc/2024.1/etc/kayobe/pulp-repo-versions.yml
+# note that some timestamps can't be used because not all repos have snapshots for them
+dnf_repos_ark_timestamp: 20240816T002610
+dnf_repos_username: slurm-app-ci
+dnf_repos_password: "{{ lookup('ansible.builtin.env', 'ARK_PASSWORD') }}"
+
+# epel installed separately
+dnf_repos_repolist:
+- file: rocky
+  name: baseos
+  base_url: "{{ dnf_repos_rocky_ark_prefix }}/BaseOS/{{ dnf_repos_rocky_ark_suffix }}"
+- file: rocky
+  name: appstream
+  base_url: "{{ dnf_repos_rocky_ark_prefix }}/AppStream/{{ dnf_repos_rocky_ark_suffix }}"
+- file: rocky
+  name: crb
+  base_url: "{{ dnf_repos_rocky_ark_prefix }}/AppStream/{{ dnf_repos_rocky_ark_suffix }}"
+- file: rocky-extras
+  name: extras
+  base_url: "{{ dnf_repos_rocky_ark_prefix }}/extras/{{ dnf_repos_rocky_ark_suffix }}"
+
+dnf_repos_epel_baseurl: https://ark.stackhpc.com/pulp/content/epel/9/Everything/x86_64/20240902T080424

ansible/roles/dnf_repos/tasks/disable_repos.yml

@@ -0,0 +1,18 @@
+---
+- name: Disable Pulp repos and remove creds
+  ansible.builtin.yum_repository:
+    file: "{{ item.file }}"
+    name: "{{ item.name }}"
+    baseurl: "{{ item.base_url }}"
+    description: "{{ item.name }}"
+    enabled: false
+  loop: "{{ dnf_repos_repolist }}"
+
+- name: Disable EPEL repo and remove creds
+  ansible.builtin.yum_repository:
+    name: epel
+    file: epel
+    description: epel
+    baseurl: "{{ dnf_repos_epel_baseurl }}"
+    gpgcheck: false
+    enabled: false

ansible/roles/dnf_repos/tasks/set_repos.yml

@@ -0,0 +1,25 @@
+---
+
+- name: Replace system repos with Pulp repos
+  ansible.builtin.yum_repository:
+    file: "{{ item.file }}"
+    name: "{{ item.name }}"
+    baseurl: "{{ item.base_url }}"
+    description: "{{ item.name }}"
+    username: "{{ dnf_repos_username }}"
+    password: "{{ dnf_repos_password }}"
+  loop: "{{ dnf_repos_repolist }}"
+
+- name: Install epel-release
+  ansible.builtin.dnf:
+    name: epel-release
+
+- name: Use Pulp EPEL repo
+  ansible.builtin.yum_repository:
+    name: epel
+    file: epel
+    description: epel
+    gpgcheck: false
+    username: "{{ dnf_repos_username }}"
+    password: "{{ dnf_repos_password }}"
+    baseurl: "{{ dnf_repos_epel_baseurl }}"

ansible/roles/openondemand/tasks/main.yml

@@ -12,6 +12,7 @@
     tasks_from: install-package.yml
     vars_from: "Rocky/{{ ansible_distribution_major_version }}.yml"
     public: yes # Expose the vars from this role to the rest of the play
+  when: appliances_mode != 'configure'
   # can't set vars: from a dict hence the workaround above
 
 - include_tasks:

ansible/roles/openondemand/tasks/pam_auth.yml

@@ -1,8 +1,5 @@
 # https://osc.github.io/ood-documentation/latest/authentication/pam.html
 ---
-- name: Install Apache PAM module
-  yum:
-    name: mod_authnz_pam
 
 - name: Enable Apache PAM module
   lineinfile: