From 1faa447597cb534f2c2cbabcfc5dd8c97b63a7a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?F=C3=A9lix-Antoine=20Fortin?= Date: Fri, 20 Mar 2026 15:23:14 -0400 Subject: [PATCH 1/2] Replace munge auth plugin by slurm --- README.md | 11 +- bootstrap.sh | 2 +- site/profile/files/base/prepare4image.sh | 1 - site/profile/files/slurm/munge_socket.pp | Bin 958 -> 0 bytes site/profile/files/slurm/munge_socket.te | 10 -- site/profile/manifests/slurm.pp | 133 ++++-------------- site/profile/templates/slurm/slurm.conf.epp | 4 +- .../profile/templates/slurm/slurmdbd.conf.epp | 2 +- 8 files changed, 36 insertions(+), 127 deletions(-) delete mode 100644 site/profile/files/slurm/munge_socket.pp delete mode 100644 site/profile/files/slurm/munge_socket.te diff --git a/README.md b/README.md index 251ac0bd6..592f4f9af 100644 --- a/README.md +++ b/README.md @@ -1545,20 +1545,15 @@ is a free and open-source job scheduler for Linux and Unix-like kernels, used by many of the world's supercomputers and computer clusters. [reference](https://en.wikipedia.org/wiki/Slurm_Workload_Manager) -> [MUNGE](https://github.com/dun/munge) (MUNGE Uid 'N' Gid Emporium) is -an authentication service for creating and validating credentials. It is -designed to be highly scalable for use in an HPC cluster environment. -[reference](https://dun.github.io/munge/) - This class installs base packages and config files that are essential -to all Slurm's roles. It also installs and configure Munge service. +to all Slurm's roles. ### parameters | Variable | Description | Type | | :---------------------- | :----------------------- | :------ | | `cluster_name` | Name of the cluster | String | -| `munge_key` | Base64 encoded Munge key | String | +| `auth_key` | Base64 encoded Slurm auth key | String | | `slurm_version` | Slurm version to install | Enum['25.05', '25.11', '26.05'] | | `os_reserved_memory` | Memory in MB reserved for the operating system on the compute nodes | Integer | | `suspend_time` | Idle time (seconds) for nodes to becomes eligible for suspension. | Integer | @@ -1578,7 +1573,7 @@ to all Slurm's roles. It also installs and configure Munge service. ```yaml profile::slurm::base::cluster_name: "%{alias('terraform.data.cluster_name')}" -profile::slurm::base::munge_key: ENC[PKCS7, ...] +profile::slurm::base::auth_key: ENC[PKCS7, ...] profile::slurm::base::slurm_version: '26.05' profile::slurm::base::os_reserved_memory: 512 profile::slurm::base::suspend_time: 3600 diff --git a/bootstrap.sh b/bootstrap.sh index 382e09198..31c411576 100755 --- a/bootstrap.sh +++ b/bootstrap.sh @@ -7,7 +7,7 @@ ENC_CMD="eyaml encrypt -o block --pkcs7-public-key=${PKCS7_KEY}" ( $ENC_CMD -l 'jupyterhub::prometheus_token' -s $(uuidgen) $ENC_CMD -l 'profile::consul::acl_api_token' -s $(uuidgen) - $ENC_CMD -l 'profile::slurm::base::munge_key' -s $(openssl rand 1024 | openssl enc -A -base64) + $ENC_CMD -l 'profile::slurm::base::auth_key' -s $(openssl rand 1024 | openssl enc -A -base64) $ENC_CMD -l 'profile::slurm::accounting::password' -s $(openssl rand -base64 9) $ENC_CMD -l 'profile::freeipa::mokey::password' -s $(openssl rand -base64 9) $ENC_CMD -l 'profile::freeipa::server::ds_password' -s $(openssl rand -base64 9) diff --git a/site/profile/files/base/prepare4image.sh b/site/profile/files/base/prepare4image.sh index f5561ff09..94e0e8181 100644 --- a/site/profile/files/base/prepare4image.sh +++ b/site/profile/files/base/prepare4image.sh @@ -45,7 +45,6 @@ systemctl daemon-reload systemctl stop rsyslog : > /var/log/messages -test -d /var/log/munge && test -f /var/log/munge/munged.log && : > /var/log/munge/munged.log : > /var/log/secure : > /var/log/cron test -d /var/log/audit && : > /var/log/audit/audit.log diff --git a/site/profile/files/slurm/munge_socket.pp b/site/profile/files/slurm/munge_socket.pp deleted file mode 100644 index cfeb03b7fcb4841d5f7dc7ba45dc3b964ddebe10..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 958 zcmbu7O-chn5QWExe;_D$ft*0}2DNdgD-Y1b*oKL520A_J!Yhd9b*1$s^I{X3RUW*q zS3muxVe0GW<9n~FDtPYv^!&`@{muBcZo2pJUHjNA;>b%EPR5R%;MDojHM1C&?esb3 zeb28iugt?X^o5hYL5?K^7=)*K5f40}_?GG%k6bW0i+PfBk_q2OgZ5z_r#U2BW$R-| zYozS!5r^KCzr4%2ZW&X^Jf9nybXgfkkJm{GscS-3VJON#pJGlmwDnY9k$MU91gg*D zfUVBIL*D$NZCFu2L-{FE6U+rvPoC5SlkhmCxla%7>V=135*~+iF|w27-7Ljse<_q? ZSGA*~qK9VZ)_Yanz;3fgWy9oIokjL diff --git a/site/profile/files/slurm/munge_socket.te b/site/profile/files/slurm/munge_socket.te deleted file mode 100644 index 81c4c011c..000000000 --- a/site/profile/files/slurm/munge_socket.te +++ /dev/null @@ -1,10 +0,0 @@ -module munge_socket 1.0; - -require { - type user_t; - type var_run_t; - class sock_file { getattr write }; -} - -#============= user_t ============== -allow user_t var_run_t:sock_file { getattr write }; \ No newline at end of file diff --git a/site/profile/manifests/slurm.pp b/site/profile/manifests/slurm.pp index 48226822d..aca7dd0c1 100644 --- a/site/profile/manifests/slurm.pp +++ b/site/profile/manifests/slurm.pp @@ -1,14 +1,14 @@ # Slurm base class that is included in each different profile. -# The class configures the slurm and munge users, install the +# The class configures the slurm user, install the # base slurm packages and configures everything that is required # on all types of nodes. # @param cluster_name Specifies the name of the cluster as it appears in slurm.conf -# @param munge_key Specifies the munge secret key that allows slurm nodes to communicate +# @param auth_key Specifies the auth secret key that allows slurm nodes to communicate # @param slurm_version Specifies which version of Slurm to install # @param os_reserved_memory Specifies the amount of memory reserved for the operating system in compute node class profile::slurm::base ( String[1, 40] $cluster_name, - String $munge_key, + String $auth_key, Enum['25.05', '25.11', '26.05'] $slurm_version, Integer $os_reserved_memory, Integer $suspend_time = 3600, @@ -40,61 +40,10 @@ before => Package['slurm'], } - group { 'munge': - ensure => 'present', - gid => '2002', - } - - user { 'munge': - ensure => 'present', - groups => 'munge', - uid => '2002', - home => '/var/lib/munge', - comment => 'MUNGE Uid N Gid Emporium', - shell => '/sbin/nologin', - before => Package['munge'], - } - package { 'xauth': ensure => 'installed', } - package { 'munge': - ensure => 'installed', - } - - # Sometime /var/run/munge is not created. - # Munge RPM provides /usr/lib/tmpfiles.d/munge.conf - # tmpfiles.d config was replaced with RuntimeDirectory as of munge 0.5.14 - # but we are stuck with 0.5.13 as upstream has not updated munge - # since 2021. The next 2 file_lines make sure munge does not rely on - # systemd-tmpfiles-setup.service. - # Ref: https://github.com/dun/munge/commit/3eed37e3ca73c14b679394df7be151d27566b0fe - # Ref: https://github.com/dun/munge/issues/75 - file_line { 'munge_runtimedirectory': - path => '/usr/lib/systemd/system/munge.service', - match => '^RuntimeDirectory=', - line => 'RuntimeDirectory=munge', - after => 'Group=munge', - require => Package['munge'], - } - - file_line { 'munge_runtimedirectorymode': - path => '/usr/lib/systemd/system/munge.service', - match => '^RuntimeDirectoryMode=', - line => 'RuntimeDirectoryMode=0755', - after => 'Group=munge', - require => Package['munge'], - } - - # Fix a warning in systemctl status munge about the location of the PID file. - file_line { 'munge_pidfile': - path => '/usr/lib/systemd/system/munge.service', - match => '^PIDFile=', - line => 'PIDFile=/run/munge/munged.pid', - require => Package['munge'], - } - file { '/var/log/slurm': ensure => 'directory', owner => 'slurm', @@ -114,12 +63,6 @@ seltype => 'usr_t', } - file { '/etc/munge': - ensure => 'directory', - owner => 'munge', - group => 'munge', - } - file { '/etc/slurm/cgroup.conf': ensure => 'file', owner => 'slurm', @@ -153,34 +96,15 @@ content => $slurm_path, } - file { '/etc/munge/munge.key': - ensure => 'file', - owner => 'munge', - group => 'munge', - mode => '0400', - content => $munge_key, - before => Service['munge'], - require => File['/etc/munge'], - } - - service { 'munge': - ensure => $ensure_munge, - enable => $ensure_munge == 'running', - subscribe => [ - File['/etc/munge/munge.key'], - File_line['munge_runtimedirectory'], - File_line['munge_runtimedirectorymode'], - File_line['munge_pidfile'], - ], - require => Package['munge'], - } - - file { '/var/log/munge/munged.log': - ensure => file, - owner => 'munge', - group => 'munge', - mode => '0640', - require => Package['munge'], + file { '/etc/slurm/slurm.key': + ensure => 'present', + owner => 'slurm', + group => 'slurm', + mode => '0600', + content => $auth_key, + require => [ + File['/etc/slurm'], + ] } $yumrepo_prefix = "https://download.copr.fedorainfracloud.org/results/cmdntrf/Slurm${slurm_version}/" @@ -199,7 +123,6 @@ name => "slurm-${slurm_version}*", require => [ Exec['enable_powertools'], - Package['munge'], Yumrepo['slurm-copr-repo'], Yumrepo['epel'], ], @@ -209,7 +132,6 @@ ensure => 'installed', require => [ Package['slurm'], - Package['munge'], Yumrepo['slurm-copr-repo'], ], } @@ -224,7 +146,6 @@ ensure => 'installed', require => [ Package['slurm'], - Package['munge'], Yumrepo['slurm-copr-repo'] ], } @@ -278,16 +199,6 @@ require => File['/etc/slurm'], } - # SELinux policy required to allow confined users to submit job with Slurm 19, 20, 21. - # Slurm commands tries to write to a socket in /var/run/munge. - # Confined users cannot stat this file, neither write to it. The policy - # allows user_t to getattr and write var_run_t sock file. - # To get the policy, we had to disable dontaudit rules with : sudo semanage -DB - selinux::module { 'munge_socket': - ensure => 'present', - source_pp => 'puppet:///modules/profile/slurm/munge_socket.pp', - } - file { '/etc/slurm/nodes.conf': ensure => 'file', owner => 'slurm', @@ -371,7 +282,6 @@ name => "slurm-slurmdbd-${slurm_version}*", require => [ Package['slurm'], - Package['munge'], Yumrepo['slurm-copr-repo'] ], } @@ -384,6 +294,7 @@ File['/etc/slurm/slurmdbd.conf'], ], subscribe => [ + File['/etc/slurm/slurm.key'], Mysql::Db['slurm_acct_db'], ], before => Service['slurmctld'], @@ -553,7 +464,6 @@ package { 'slurm-slurmctld': ensure => 'installed', require => [ - Package['munge'], Package['slurm'], ], } @@ -569,7 +479,8 @@ File['/etc/slurm/slurm-addendum.conf'], File['/etc/slurm/gres.conf'], File['/etc/slurm/nodes.conf'], - ], + File['/etc/slurm/slurm.key'], + ] } logrotate::rule { 'slurmctld': @@ -802,6 +713,7 @@ File['/etc/slurm/slurm.conf'], File['/etc/slurm/slurm-addendum.conf'], File['/etc/slurm/nodes.conf'], + File['/etc/slurm/slurm.key'], ], require => [ Package['slurm-slurmd'], @@ -846,4 +758,17 @@ # controller through Slurm command-line tools. class profile::slurm::submitter { contain profile::slurm::base + package { 'slurm-sackd': + require => Yumrepo['slurm-copr-repo'] + } + service { 'sackd': + ensure => running, + enable => true, + subscribe => [ + File['/etc/slurm/slurm.key'], + ], + require => [ + Package['slurm-sackd'], + ], + } } diff --git a/site/profile/templates/slurm/slurm.conf.epp b/site/profile/templates/slurm/slurm.conf.epp index 3c4ccfb36..e9665a624 100644 --- a/site/profile/templates/slurm/slurm.conf.epp +++ b/site/profile/templates/slurm/slurm.conf.epp @@ -22,8 +22,8 @@ JobAcctGatherParams=NoOverMemoryKill # MANAGEMENT POLICIES ClusterName=<%= $cluster_name %> -AuthType=auth/munge -CryptoType=crypto/munge +AuthType=auth/slurm +CredType=cred/slurm SlurmUser=slurm # SCHEDULER CONFIGURATIONS SchedulerType=sched/backfill diff --git a/site/profile/templates/slurm/slurmdbd.conf.epp b/site/profile/templates/slurm/slurmdbd.conf.epp index bccca37a0..16b70786d 100644 --- a/site/profile/templates/slurm/slurmdbd.conf.epp +++ b/site/profile/templates/slurm/slurmdbd.conf.epp @@ -1,4 +1,4 @@ -AuthType=auth/munge +AuthType=auth/slurm LogFile=/var/log/slurm/slurmdbd.log PidFile=/var/run/slurmdbd/slurmdbd.pid DbdHost=<%= $dbd_host %> From 3cffca1a84277acf93b62848bc864d6b346e00d0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?F=C3=A9lix-Antoine=20Fortin?= Date: Mon, 23 Mar 2026 14:42:56 -0400 Subject: [PATCH 2/2] Add dep on package slurm for slurm-sackd --- site/profile/manifests/slurm.pp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/site/profile/manifests/slurm.pp b/site/profile/manifests/slurm.pp index aca7dd0c1..620af732e 100644 --- a/site/profile/manifests/slurm.pp +++ b/site/profile/manifests/slurm.pp @@ -758,9 +758,13 @@ # controller through Slurm command-line tools. class profile::slurm::submitter { contain profile::slurm::base + package { 'slurm-sackd': - require => Yumrepo['slurm-copr-repo'] + require => [ + Package['slurm'], + ] } + service { 'sackd': ensure => running, enable => true,