You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,8 +31,7 @@ It requires an OpenStack cloud, and an Ansible "deploy host" with access to that
31
31
32
32
Before starting ensure that:
33
33
- You have root access on the deploy host.
34
-
- You can create instances using a Rocky 9 GenericCloud image (or an image based on that).
35
-
-**NB**: In general it is recommended to use the [latest released image](https://github.com/stackhpc/ansible-slurm-appliance/releases) which already contains the required packages. This is built and tested in StackHPC's CI.
34
+
- You can create instances from the [latest Slurm appliance image](https://github.com/stackhpc/ansible-slurm-appliance/releases), which already contains the required packages. This is built and tested in StackHPC's CI.
36
35
- You have an SSH keypair defined in OpenStack, with the private key available on the deploy host.
37
36
- Created instances have access to internet (note proxies can be setup through the appliance if necessary).
38
37
- Created instances have accurate/synchronised time (for VM instances this is usually provided by the hypervisor; if not or for bare metal instances it may be necessary to configure a time service via the appliance).
@@ -50,6 +49,7 @@ These instructions assume the deployment host is running Rocky Linux 8:
Copy file name to clipboardExpand all lines: ansible/roles/basic_users/README.md
+96-26Lines changed: 96 additions & 26 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,26 +2,58 @@
2
2
basic_users
3
3
===========
4
4
5
-
Setup users on cluster nodes using `/etc/passwd` and manipulating `$HOME`, i.e. without requiring LDAP etc. Features:
5
+
Setup users on cluster nodes using `/etc/passwd` and manipulating `$HOME`, i.e.
6
+
without requiring LDAP etc. Features:
6
7
- UID/GID is consistent across cluster (and explicitly defined).
7
-
- SSH key generated and propagated to all nodes to allow login between cluster nodes.
8
+
- SSH key generated and propagated to all nodes to allow login between cluster
9
+
nodes.
8
10
- An "external" SSH key can be added to allow login from elsewhere.
9
-
- Login to the control node is prevented.
11
+
- Login to the control node is prevented (by default).
10
12
- When deleting users, systemd user sessions are terminated first.
11
13
12
-
Requirements
13
-
------------
14
-
- $HOME (for normal users, i.e. not `centos`) is assumed to be on a shared filesystem.
14
+
> [!IMPORTANT] The defaults for this role assumes that `$HOME` for users
15
+
managed by this role (e.g. not `rocky` and other system users) is on a shared
16
+
filesystem. The export of this shared filesystem may be root squashed if its
17
+
server is in the `basic_user` group - see configuration examples below.
15
18
16
19
Role Variables
17
20
--------------
18
21
19
-
-`basic_users_users`: Optional, default empty list. A list of mappings defining information for each user. In general, mapping keys/values are passed through as parameters to [ansible.builtin.user](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/user_module.html) and default values are as given there. However:
20
-
-`create_home`, `generate_ssh_key` and `ssh_key_comment` are set automatically; this assumes home directories are on a cluster-shared filesystem.
21
-
-`uid` should be set, so that the UID/GID is consistent across the cluster (which Slurm requires).
22
-
-`shell` if *not* set will be `/sbin/nologin` on the `control` node and the default shell on other users. Explicitly setting this defines the shell for all nodes.
23
-
- An additional key `public_key` may optionally be specified to define a key to log into the cluster.
24
-
- An additional key `sudo` may optionally be specified giving a string (possibly multiline) defining sudo rules to be templated.
22
+
-`basic_users_homedir_server`: Optional inventory hostname in the `basic_users`
23
+
group defining the host to use to create home directories. If the home
24
+
directory export is root squashed, this host *must* be the home directory
25
+
server. Default is the `control` node which is appropriate for the default
26
+
appliance configuration. Not relevant if `create_home` is false for all users.
27
+
-`basic_users_homedir_server_path`: Optional path prefix for home directories on
28
+
the `basic_users_homedir_server`, i.e. on the "server side". Default is
29
+
`/exports/home` which is appropriate for the default appliance configuration.
30
+
-`basic_users_homedir_client`: Optional inventory hostname in the `basic_users`
31
+
group defining the host to use to create ssh keys etc in home directories.
32
+
This should be a host mounting the home directories. Default is the first
33
+
node in the `login` group which is appropriate for the default appliance
34
+
configuration.
35
+
-`basic_users_users`: Optional, default empty list. A list of mappings defining
36
+
information for each user. In general, mapping keys/values are passed through
37
+
as parameters to [ansible.builtin.user](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/user_module.html)
38
+
and default values are as given there, with the following differences:
39
+
-`generate_ssh_key`: Default is `true`, and the generated key is added to
40
+
the user's authorized keys.
41
+
-`ssh_key_comment`: Default is user name.
42
+
-`home`: Set automatically based on the user name and
43
+
`basic_users_homedir_server_path`. Can be overriden for users with
44
+
non-standard home directory paths.
45
+
-`uid`: Should be set, so that the UID/GID is consistent across the cluster
46
+
(which Slurm requires).
47
+
-`shell`: If *not* set will be `/sbin/nologin` on the `control` node to
48
+
prevent users logging in to this node, and the default shell on other
49
+
nodes. Explicitly setting this defines the shell for all nodes and if the
50
+
shared home directories are mounted on the control node will allow the
51
+
user to log in to the control node.
52
+
-`public_key`: Optional, define a key to log into the cluster with.
53
+
-`sudo`: Optional, a (possibly multiline) string defining sudo rules for the
54
+
user.
55
+
-`ssh_key_type` defaults to `ed25519` instead of the `ansible.builtin.user`
56
+
default of `rsa`.
25
57
- Any other keys may present for other purposes (i.e. not used by this role).
26
58
-`basic_users_groups`: Optional, default empty list. A list of mappings defining information for each group. Mapping keys/values are passed through as parameters to [ansible.builtin.group](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/group_module.html) and default values are as given there.
27
59
-`basic_users_override_sssd`: Optional bool, default false. Whether to disable `sssd` when ensuring users/groups exist with this role. Permits creating local users/groups even if they clash with users provided via sssd (e.g. from LDAP). Ignored if host is not in group `sssd` as well. Note with this option active `sssd` will be stopped and restarted each time this role is run.
@@ -31,29 +63,67 @@ Dependencies
31
63
32
64
None.
33
65
34
-
Example Playbook
35
-
----------------
66
+
Example Configurations
67
+
----------------------
36
68
37
-
```yaml
38
-
- hosts: basic_users
39
-
become: yes
40
-
gather_facts: yes
41
-
tasks:
42
-
- import_role:
43
-
name: basic_users
44
-
```
45
-
46
-
Example variables, to create user `alice` and delete user `bob`:
69
+
With default appliance NFS configuration, create user `alice` with access
70
+
to all nodes except the control node, and delete user `bob`:
47
71
48
72
```yaml
49
73
basic_users_users:
50
74
- comment: Alice Aardvark
51
75
name: alice
52
76
uid: 2005
53
-
public_key: ssh-rsa ...
77
+
public_key: ssh-ed25519 ...
54
78
- comment: Bob Badger
55
79
name: bob
56
80
uid: 2006
57
-
public_key: ssh-rsa ...
81
+
public_key: ssh-ed25519 ...
58
82
state: absent
59
83
```
84
+
85
+
Using an external share which:
86
+
- does not root squash (so this role can create directories on it)
87
+
- is mounted to all nodes including the control node (so this role can set
88
+
authorized keys there)
89
+
90
+
Create user `Carol`:
91
+
92
+
```yaml
93
+
basic_users_homedir_host: "{{ ansible_play_hosts | first }}" # doesn't matter which host is used
94
+
basic_users_homedir_host_path: /home # homedir_host is client not server
95
+
basic_users_user:
96
+
- comment: Carol Crane
97
+
name: carol
98
+
uid: 2007
99
+
public_key: ssh-ed25519 ...
100
+
```
101
+
102
+
Using an external share which *does* root squash, so home directories cannot be
103
+
created by this role and must already exist, create user `Dan`:
104
+
105
+
```yaml
106
+
basic_users_homedir_host: "{{ ansible_play_hosts | first }}"
107
+
basic_users_homedir_host_path: /home
108
+
basic_users_users:
109
+
- comment: Dan Deer
110
+
create_home: false
111
+
name: dan
112
+
uuid: 2008
113
+
public_key: ssh-ed25519 ...
114
+
```
115
+
116
+
Using NFS exported from the control node, but mounted to all nodes (so that
117
+
authorized keys applies to all nodes), create user `Erin` with passwordless sudo:
118
+
119
+
```yaml
120
+
basic_users_users:
121
+
- comment: Erin Eagle
122
+
name: erin
123
+
uid: 2009
124
+
shell: /bin/bash # override default nologin on control
125
+
groups:
126
+
- adm # enables ssh to compute nodes even without a job running
0 commit comments