Merge branch 'main' into eessi

Author: claudia-lola

.github/workflows/fatimage.yml

@@ -36,10 +36,10 @@ jobs:
         build:
           - image_name: openhpc-RL8
             source_image_name: Rocky-8-GenericCloud-Base-8.10-20240528.0.x86_64.raw
-            inventory_groups: control,compute,login,update
+            inventory_groups: fatimage
           - image_name: openhpc-RL9
             source_image_name: Rocky-9-GenericCloud-Base-9.6-20250531.0.x86_64.qcow2
-            inventory_groups: control,compute,login,update
+            inventory_groups: fatimage
     env:
       ANSIBLE_FORCE_COLOR: True
       OS_CLOUD: openstack

.github/workflows/nightly-cleanup.yml

@@ -46,53 +46,20 @@ jobs:
           echo "${{ secrets[format('{0}_CLOUDS_YAML', env.CI_CLOUD)] }}" > ~/.config/openstack/clouds.yaml
         shell: bash
 
-      - name: Find CI clusters
+      - name: Delete all CI clusters
         run: |
           . venv/bin/activate
-          CI_CLUSTERS=$(openstack server list | grep --only-matching 'slurmci-RL.-[0-9]\+'  | sort | uniq || true)
-          echo "DEBUG: Raw CI clusters: $CI_CLUSTERS"
-      
-          if [[ -z "$CI_CLUSTERS" ]]; then
-            echo "No matching CI clusters found."
-          else
-            # Flatten multiline value so can be passed as env var
-            CI_CLUSTERS_FORMATTED=$(echo "$CI_CLUSTERS" | tr '\n' ' ' | sed 's/ $//')
-            echo "DEBUG: Formatted CI clusters: $CI_CLUSTERS_FORMATTED"
-            echo "ci_clusters=$CI_CLUSTERS_FORMATTED" >> "$GITHUB_ENV"
-          fi
+          ./dev/delete-cluster.py slurmci-RL --force
         shell: bash
-      
-      - name: Delete CI clusters
+
+      - name: Delete all CI extra build VMs and volumes
         run: |
           . venv/bin/activate
-          if [[ -z ${ci_clusters} ]]; then
-            echo "No clusters to delete."
-            exit 0
-          fi
-
-          for cluster_prefix in ${ci_clusters}
-          do
-            echo "Processing cluster: $cluster_prefix"
-
-            # Get all servers with the matching name for control node
-            CONTROL_SERVERS=$(openstack server list --name "${cluster_prefix}-control" --format json)
-
-            # Get unique server names to avoid duplicate cleanup
-            UNIQUE_NAMES=$(echo "$CONTROL_SERVERS" | jq -r '.[].Name' | sort | uniq)
-            for name in $UNIQUE_NAMES; do
-              echo "Deleting cluster with control node: $name"
-
-              # Get the first matching server ID by name
-              server=$(echo "$CONTROL_SERVERS" | jq -r '.[] | select(.Name=="'"$name"'") | .ID' | head -n1)
-
-              # Make sure server still exists (wasn't deleted earlier)
-              if ! openstack server show "$server" &>/dev/null; then
-                echo "Server $server no longer exists, skipping $name."
-                continue
-              fi
+          ./dev/delete-cluster.py openhpc-extra-RL --force
+        shell: bash
 
-              echo "Deleting cluster $cluster_prefix (server $server)..."
-              ./dev/delete-cluster.py "$cluster_prefix" --force
-            done
-          done
+      - name: Delete all fatimage build VMs and volumes
+        run: |
+          . venv/bin/activate
+          ./dev/delete-cluster.py openhpc-RL --force
         shell: bash

ansible/adhoc/sync-pulp.yml

@@ -5,7 +5,5 @@
         name: pulp_site
         tasks_from: sync.yml
       vars:
-        pulp_site_target_arch: "x86_64"
-        pulp_site_target_distribution: "rocky"
         # default distribution to *latest* specified for baseos repo:
         pulp_site_target_distribution_version: "{{ dnf_repos_repos['baseos'].keys() | map('float') | sort | last }}"

ansible/fatimage.yml

@@ -117,7 +117,7 @@
     - name: Install OpenHPC
       ansible.builtin.import_role:
         name: stackhpc.openhpc
-        tasks_from: install.yml
+        tasks_from: install-ohpc.yml
       when: "'openhpc' in group_names"
 
     # - import_playbook: portal.yml

ansible/roles/nhc/README.md

@@ -37,6 +37,7 @@ When the `ansible/site.yml` playbook is run this will automatically:
 
    - Filesystem mounts
    - Ethernet interfaces
+   - InfiniBand interfaces
 
    See `/etc/nhc/nhc.conf` on a compute node for the full configuration.
 

ansible/roles/nhc/templates/nhc.conf.j2

@@ -16,5 +16,10 @@
 {{ ansible_fqdn }} || check_hw_eth {{ iface }}
 {% endfor %}
 
+## InfiniBand interface checks
+{% for iface in ansible_interfaces | select('match', 'ib') %}
+{{ ansible_fqdn }} || check_hw_ib {{ (ansible_facts[iface]['speed'] / 1000) | int }} {{ iface }}
+{% endfor %}
+
 ## Site-specific checks
 {{ nhc_config_extra }}

ansible/roles/sshd/README.md

@@ -6,5 +6,6 @@ Configure sshd.
 
 - `sshd_password_authentication`: Optional bool. Whether to enable password login. Default `false`.
 - `sshd_disable_forwarding`: Optional bool. Whether to disable all forwarding features (X11, ssh-agent, TCP and StreamLocal). Default `true`.
+- `sshd_allow_local_forwarding`: Optional bool. Whether to allow limited forwarding for the Visual Studio Code Remote - SSH extension. Use together with `sshd_disable_forwarding: false`. NOTE THIS MAY BE INSECURE! Default `false`.
 - `sshd_conf_src`: Optional string. Path to sshd configuration template. Default is in-role template.
 - `sshd_conf_dest`: Optional string. Path to destination for sshd configuration file. Default is `/etc/ssh/sshd_config.d/10-ansible.conf` which overrides `50-{cloud-init,redhat}` files, if present.

ansible/roles/sshd/defaults/main.yml

@@ -1,5 +1,6 @@
 ---
 sshd_password_authentication: false
 sshd_disable_forwarding: true
+sshd_allow_local_forwarding: false
 sshd_conf_src: sshd.conf.j2
 sshd_conf_dest: /etc/ssh/sshd_config.d/10-ansible.conf

ansible/roles/sshd/templates/sshd.conf.j2

@@ -1,3 +1,7 @@
 # {{ ansible_managed }}
 PasswordAuthentication {{ 'yes' if sshd_password_authentication | bool else 'no' }}
 DisableForwarding {{ 'yes' if sshd_disable_forwarding | bool else 'no' }}
+{% if sshd_allow_local_forwarding %}
+AllowTcpForwarding local
+PermitOpen 127.0.0.1:*
+{% endif %}

ansible/roles/zenith_proxy/tasks/main.yml

@@ -61,6 +61,8 @@
     group: "{{ zenith_proxy_podman_user }}"
     mode: "0755"
   become: true
+  delegate_to: "{{ groups['control'] | first }}"
+  run_once: true
 
 - name: Initialise Zenith client
   # Use a foreground command rather than the podman_container module as I could not