Skip to content

Commit d824f4a

Browse files
sjpbsjpb
authored
Merge branch 'main' into update/tf-provider-openstack
2 parents 839e45d + d474a4f commit d824f4a

File tree

8 files changed

+38
-30
lines changed

8 files changed

+38
-30
lines changed

‎.github/workflows/stackhpc.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -182,9 +182,8 @@ jobs:
182182
run: |
183183
. venv/bin/activate
184184
. environments/.stackhpc/activate
185-
ansible-playbook -v --limit compute ansible/adhoc/rebuild.yml
186-
ansible-playbook -v ansible/ci/check_slurm.yml
187185
ansible-playbook -v ansible/adhoc/reboot_via_slurm.yml
186+
ansible-playbook -v ansible/ci/check_slurm.yml
188187
189188
- name: Check sacct state survived reimage
190189
run: |

‎ansible/roles/compute_init/README.md‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,13 @@
33
Experimental functionality to allow compute nodes to rejoin the cluster after
44
a reboot without running the `ansible/site.yml` playbook.
55

6+
**CAUTION:** The approach used here of exporting cluster secrets over NFS
7+
is considered to be a security risk due to the potential for cluster users to
8+
mount the share on a user-controlled machine by tunnelling through a login
9+
node. This feature should not be enabled on production clusters at this time.
10+
611
To enable this:
7-
1. Add the `compute` group (or a subset) into the `compute_init` group. This is
8-
the default when using cookiecutter to create an environment, via the
9-
"everything" template.
12+
1. Add the `compute` group (or a subset) into the `compute_init` group.
1013
2. Build an image which includes the `compute_init` group. This is the case
1114
for StackHPC-built release images.
1215
3. Enable the required functionalities during boot, by setting the

‎ansible/roles/proxy/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@ Define http/s proxy configuration.
66

77
- `proxy_http_proxy`: Required. Address of http proxy. E.g. "http://10.1.0.28:3128" for a Squid proxy on default port.
88
- `proxy_https_proxy`: Optional. Address of https proxy. Default is `{{ proxy_http_proxy }}`.
9-
- `proxy_no_proxy`: Optional. Comma-separated list of addresses not to proxy. Default is to concatenate `inventory_hostname` (for hostnames) and `ansible_host` (for host IPs) for all Ansible hosts.
9+
- `proxy_no_proxy_extra`: Optional. List of additional addresses not to proxy. Will be combined with default list which includes `inventory_hostname` (for hostnames) and `ansible_host` (for host IPs) for all Ansible hosts.
1010
- `proxy_dnf`: Optional bool. Whether to configure yum/dnf proxying through `proxy_http_proxy`. Default `true`.
1111
- `proxy_systemd`: Optional bool. Whether to give processes started by systemd the above http, https and no_proxy configuration. **NB** Running services will need restarting if this is changed. Default `true`.

‎ansible/roles/proxy/defaults/main.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
1-
# proxy_http_proxy:
1+
# proxy_http_proxy:
22
proxy_https_proxy: "{{ proxy_http_proxy }}"
3-
proxy_no_proxy: "{{ (['localhost', '127.0.0.1'] + groups['all'] + hostvars.values() | map(attribute='ansible_host')) | sort | join(',') }}"
3+
proxy_no_proxy_defaults: "{{ ['localhost', '127.0.0.1'] + groups['all'] + hostvars.values() | map(attribute='ansible_host') }}"
4+
proxy_no_proxy_extras: []
5+
proxy_no_proxy: "{{ (proxy_no_proxy_defaults + proxy_no_proxy_extras) | sort | join(',') }}"
46
proxy_dnf: true
57
proxy_systemd: true

‎dev/setup-env.sh‎

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,28 +2,30 @@
22

33
set -euo pipefail
44

5-
if [[ -f /etc/os-release ]]; then
6-
. /etc/os-release
7-
OS=$ID
8-
OS_VERSION=$VERSION_ID
9-
else
10-
exit 1
11-
fi
5+
PYTHON_VERSION=${PYTHON_VERSION:-}
126

13-
MAJOR_VERSION=$(echo $OS_VERSION | cut -d. -f1)
7+
if [[ "$PYTHON_VERSION" == "" ]]; then
8+
if [[ -f /etc/os-release ]]; then
9+
. /etc/os-release
10+
OS=$ID
11+
OS_VERSION=$VERSION_ID
12+
else
13+
exit 1
14+
fi
1415

15-
PYTHON_VERSION=""
16+
MAJOR_VERSION=$(echo $OS_VERSION | cut -d. -f1)
1617

17-
if [[ "$OS" == "ubuntu" && "$MAJOR_VERSION" == "22" ]]; then
18-
PYTHON_VERSION="/usr/bin/python3.10"
19-
elif [[ "$OS" == "rocky" && "$MAJOR_VERSION" == "8" ]]; then
20-
# python3.9+ doesn't have selinux bindings
21-
PYTHON_VERSION="/usr/bin/python3.8" # use `sudo yum install python38` on Rocky Linux 8 to install this
22-
elif [[ "$OS" == "rocky" && "$MAJOR_VERSION" == "9" ]]; then
23-
PYTHON_VERSION="/usr/bin/python3.9"
24-
else
25-
echo "Unsupported OS version: $OS $MAJOR_VERSION"
26-
exit 1
18+
if [[ "$OS" == "ubuntu" && "$MAJOR_VERSION" == "22" ]]; then
19+
PYTHON_VERSION="/usr/bin/python3.10"
20+
elif [[ "$OS" == "rocky" && "$MAJOR_VERSION" == "8" ]]; then
21+
# python3.9+ doesn't have selinux bindings
22+
PYTHON_VERSION="/usr/bin/python3.8" # use `sudo yum install python38` on Rocky Linux 8 to install this
23+
elif [[ "$OS" == "rocky" && "$MAJOR_VERSION" == "9" ]]; then
24+
PYTHON_VERSION="/usr/bin/python3.9"
25+
else
26+
echo "Unsupported OS version: $OS $MAJOR_VERSION"
27+
exit 1
28+
fi
2729
fi
2830

2931
if [[ ! -d "venv" ]]; then

‎docs/openondemand.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ The above functionality is configured by running the `ansible/portal.yml` playbo
3030

3131
See the [ansible/roles/openondemand/README.md](../ansible/roles/openondemand/README.md) for more details on the variables described below.
3232

33-
The following variables have been given default values to allow Open OnDemand to work in a newly created environment without additional configuration, but generally should be overridden in `environment/site/inventory/group_vars/all/` with site-specific values:
33+
The following variables have been given default values to allow Open OnDemand to work in a newly created environment without additional configuration, but generally should be overridden in `environments/site/inventory/group_vars/all/` with site-specific values:
3434
- `openondemand_servername` - this must be defined for both `openondemand` and `grafana` hosts (when Grafana is enabled). Default is `ansible_host` (i.e. the IP address) of the first host in the `openondemand` group.
3535
- `openondemand_auth` and any corresponding options. Defaults to `basic_pam`.
3636
- `openondemand_desktop_partition` and `openondemand_jupyter_partition` if the corresponding inventory groups are defined. Defaults to the first compute group defined in the `compute` OpenTofu variable in `environments/$ENV/tofu`.

‎environments/.stackhpc/inventory/extra_groups‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,3 +41,6 @@ control
4141

4242
[cacerts:children]
4343
cluster
44+
45+
[compute_init:children]
46+
compute

‎environments/common/layouts/everything‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -93,9 +93,8 @@ cluster
9393
[sshd]
9494
# Hosts where the OpenSSH server daemon should be configured
9595

96-
[compute_init:children]
96+
[compute_init]
9797
# EXPERIMENTAL: Compute hosts to enable joining cluster on boot on
98-
compute
9998

10099
[k3s:children]
101100
# Hosts to run k3s server/agent

0 commit comments

Comments
 (0)