Merge branch 'main' into eessi

Author: sjpb

.ansible-lint.yml

@@ -6,8 +6,6 @@ skip_list:
   - jinja[spacing]
   - galaxy[no-changelog]
   - meta-runtime[unsupported-version]
-
-warn_list:
   - name[missing]
   - name[play]
   - var-naming

.github/workflows/stackhpc.yml

@@ -107,7 +107,12 @@ jobs:
           . venv/bin/activate
           . environments/.stackhpc/activate
           cd "$STACKHPC_TF_DIR"
-          tofu apply -auto-approve -var-file="${{ env.CI_CLOUD }}.tfvars"
+          max_retries=3
+          delay=30
+          for i in $(seq 1 $max_retries); do
+            tofu apply -auto-approve -var-file="${{ env.CI_CLOUD }}.tfvars" && break
+            [ "$i" -lt "$max_retries" ] && sleep $delay || exit 1
+          done
 
       - name: Delete infrastructure if provisioning failed
         run: |

ansible/fatimage.yml

@@ -206,6 +206,7 @@
       ansible.builtin.include_role:
         name: hpctests
         tasks_from: source-hpl.yml
+      when: "'hpctests' in group_names"
 
 - hosts: prometheus
   become: true

ansible/roles/eessi/defaults/main.yaml

@@ -1,4 +1,6 @@
 ---
+cvmfs_release_version: "6-3"
+
 # Default to 10GB
 cvmfs_quota_limit_mb: 10000
 
@@ -9,4 +11,4 @@ cvmfs_config_default:
 cvmfs_config_overrides: {}
 cvmfs_config: "{{ cvmfs_config_default | combine(cvmfs_config_overrides) }}"
 
-cvmfs_gpg_checksum: "sha256:4ac81adff957565277cfa6a4a330cdc2ce5a8fdd73b8760d1a5a32bef71c4bd6"
+cvmfs_gpg_checksum: "sha256:5c60679d307a96524204c127250e8ebdda66a459659faa1718bdf32dde1d7069"

ansible/roles/eessi/tasks/install.yml

@@ -3,18 +3,17 @@
 - name: Download Cern GPG key
   # checkov:skip=CKV2_ANSIBLE_2: "Ensure that HTTPS url is used with get_url"
   ansible.builtin.get_url:
-    url: http://cvmrepo.web.cern.ch/cvmrepo/yum/RPM-GPG-KEY-CernVM
+    url: https://cvmrepo.web.cern.ch/cvmrepo/yum/RPM-GPG-KEY-CernVM-2048
     dest: ./cvmfs-key.gpg
     checksum: "{{ cvmfs_gpg_checksum }}"
     mode: "0644"
 
 - name: Import downloaded GPG key # noqa: no-changed-when
   ansible.builtin.command: rpm --import cvmfs-key.gpg # noqa: command-instead-of-module
+
 - name: Add CVMFS repo
-  # checkov:skip=CKV2_ANSIBLE_4: "Ensure that packages with untrusted or missing GPG signatures are not used by dnf"
   ansible.builtin.dnf:
-    name: https://ecsft.cern.ch/dist/cvmfs/cvmfs-release/cvmfs-release-latest.noarch.rpm
-    disable_gpg_check: true
+    name: "https://ecsft.cern.ch/dist/cvmfs/cvmfs-release/cvmfs-release-{{ cvmfs_release_version }}.noarch.rpm"
 
 - name: Install CVMFS
   ansible.builtin.dnf:

ansible/roles/nhc/templates/nhc.conf.j2

@@ -8,7 +8,7 @@
 {# /efi is mounted both directly and via systemd1 autofs, which NHC can't cope with #}
 {# use `awk '{print $5 " " $10 " " $4 " " $9}' /proc/self/mountinfo | sort -k1` to check that is the only case #}
 {% set mount_mode = 'rw' if 'rw' in mount.options.split(',') else 'ro' %}
-{{ ansible_fqdn }} || check_fs_mount_{{ mount_mode }} -t "{{ mount.fstype }}" -s "{{ mount.device }}" -f "{{ mount.mount }}"
+{{ ansible_fqdn }} || check_fs_mount_{{ mount_mode }} -t "{{ mount.fstype }}" -s "{{ mount.device | replace(' ', '\\040') }}" -f "{{ mount.mount }}"
 {% endfor %}
 
 ## Ethernet interface checks

dev/image-set-properties.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/bash
+# Set image properties correctly for Slurm Appliance images
+#
+# Usage:
+#   dev/image-set-properties.sh $IMAGE_NAME_OR_ID
+
+set -euo pipefail
+
+image=${1?param missing - image name or ID}
+echo getting image format ...
+format=$(openstack image show -c disk_format -f value "${image}")
+
+echo setting constant properties ...
+set -x
+openstack image set \
+--property hw_machine_type=q35 \
+--property hw_architecture=x86_64 \
+--property hw_vif_multiqueue_enabled=true \
+--property hw_firmware_type=uefi \
+--property os_distro=rocky \
+--property os_type=linux \
+--property os_admin_user=rocky \
+"$image"
+
+set +x
+if [[ "$format" = raw ]]; then
+    echo setting raw properties...
+    set -x
+    openstack image set \
+    --property hw_scsi_model=virtio-scsi \
+    --property hw_disk_bus=scsi \
+    "$image"
+else
+    echo setting qcow2 properties
+    set -x
+    openstack image set \
+    --property hw_scsi_model=virtio-scsi \
+    --property hw_disk_bus=scsi \
+    --property hw_scsi_model=virtio \
+    "$image"
+fi

docs/image-build.md

@@ -128,10 +128,22 @@ For either a site-specific fat-image build or an extra-build:
    then delete the failed volume, select cancelling the build when Packer asks,
    and then retry. This is [OpenStack bug 1823445](https://bugs.launchpad.net/cinder/+bug/1823445).
 
+   The image name and UUID will be output near the end of a build, e.g.:
+
+   ```shell
+   ==> openstack.openhpc: Waiting for image openhpc-251017-1156-046b6133 (image id: 86ac2073-0a86-4fbf-935c-f1b6e6392e90) to become ready...
+   ```
+
 6. The built image will be automatically uploaded to OpenStack. By default it
    will have a name prefixed `openhpc` and including a timestamp and a shortened
    Git hash.
 
+7. Set the image properties. From the repository root run:
+
+   ```shell
+   dev/image-set-properties.sh $IMAGE_NAME_OR_ID
+   ```
+
 ## Build Process
 
 In summary, Packer creates an OpenStack VM, runs Ansible on that, shuts it down, then creates an image from the root disk.

environments/.stackhpc/tofu/cluster_image.auto.tfvars.json

@@ -1,6 +1,6 @@
 {
   "cluster_image": {
-    "RL8": "openhpc-RL8-251008-0814-cda7084d",
-    "RL9": "openhpc-RL9-251008-0814-cda7084d"
+    "RL8": "openhpc-RL8-251021-1221-915ed3fc",
+    "RL9": "openhpc-RL9-251021-1221-915ed3fc"
   }
 }

environments/common/inventory/groups

@@ -22,9 +22,8 @@ login
 control
 compute
 
-[hpctests:children]
+[hpctests]
 # Login group to use for running mpi-based testing.
-login
 
 [additional]
 # Additional nodes to include in "cluster" group