Skip to content

Disable compute-init by default & warn of security issue #585

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Feb 19, 2025
Merged

Disable compute-init by default & warn of security issue #585

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
458e0bb
Disable compute-init by default, warn of security issue
sjpb Feb 18, 2025
db1e2cb
Update compute-init readme now not cookiecutter default
sjpb Feb 18, 2025
5acf014
reenable compute-init for stackhpc b/c CI tests it
sjpb Feb 19, 2025
9591f58
don't reimage compute nodes twice
sjpb Feb 19, 2025
f318980
Merge branch 'main' into fix/compute-init-unsafe-nfs
sjpb Feb 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions .github/workflows/stackhpc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,9 +182,8 @@ jobs:
run: |
. venv/bin/activate
. environments/.stackhpc/activate
ansible-playbook -v --limit compute ansible/adhoc/rebuild.yml
ansible-playbook -v ansible/ci/check_slurm.yml
ansible-playbook -v ansible/adhoc/reboot_via_slurm.yml
ansible-playbook -v ansible/ci/check_slurm.yml

- name: Check sacct state survived reimage
run: |
Expand Down
9 changes: 6 additions & 3 deletions ansible/roles/compute_init/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,13 @@
Experimental functionality to allow compute nodes to rejoin the cluster after
a reboot without running the `ansible/site.yml` playbook.

**CAUTION:** The approach used here of exporting cluster secrets over NFS
is considered to be a security risk due to the potential for cluster users to
mount the share on a user-controlled machine by tunnelling through a login
node. This feature should not be enabled on production clusters at this time.

To enable this:
1. Add the `compute` group (or a subset) into the `compute_init` group. This is
the default when using cookiecutter to create an environment, via the
"everything" template.
1. Add the `compute` group (or a subset) into the `compute_init` group.
2. Build an image which includes the `compute_init` group. This is the case
for StackHPC-built release images.
3. Enable the required functionalities during boot, by setting the
Expand Down
3 changes: 3 additions & 0 deletions environments/.stackhpc/inventory/extra_groups
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,3 +41,6 @@ control

[cacerts:children]
cluster

[compute_init:children]
compute
3 changes: 1 addition & 2 deletions environments/common/layouts/everything
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,9 +93,8 @@ cluster
[sshd]
# Hosts where the OpenSSH server daemon should be configured

[compute_init:children]
[compute_init]
# EXPERIMENTAL: Compute hosts to enable joining cluster on boot on
compute

[k3s:children]
# Hosts to run k3s server/agent
Expand Down