Skip to content

Commit 5269d54

Browse files
authored
Use Ark repos for Open Ondemand installs (with in-repo GPG key) (#831)
* skip entire task files for ondemand apps during extra builds * provide ondemand GPG key in repo * make osc.ood defaults provided by openondemand role apply during install too * fix ansible-lint errors * bump CI image * fix osc.ood defaults overriding openondemand role defaults * fix ondemand package version * bump CI image
1 parent 5544eb5 commit 5269d54

File tree

9 files changed

+277
-185
lines changed

9 files changed

+277
-185
lines changed

ansible/fatimage.yml

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -131,40 +131,31 @@
131131
when: "'openhpc' in group_names"
132132

133133
# - import_playbook: portal.yml
134-
- name: Open OnDemand server (packages)
134+
- name: Install Open OnDemand server and apps
135135
ansible.builtin.include_role:
136-
name: osc.ood
137-
tasks_from: install-package.yml
138-
vars_from: "Rocky/{{ ansible_distribution_major_version }}.yml"
139-
when: "'openondemand' in group_names"
140-
141-
- name: Open OnDemand server (apps)
142-
ansible.builtin.include_role:
143-
name: osc.ood
144-
tasks_from: install-apps.yml
145-
vars_from: "Rocky/{{ ansible_distribution_major_version }}.yml"
136+
name: openondemand
146137
when: "'openondemand' in group_names"
147138

148139
- name: Open OnDemand remote desktop # Used for plain desktop and matlab
149-
ansible.builtin.import_role:
140+
ansible.builtin.include_role:
150141
name: openondemand
151142
tasks_from: vnc_compute.yml
152143
when: "'openondemand_desktop' or 'openondemand_matlab' in group_names"
153144

154145
- name: Open OnDemand Jupyter node
155-
ansible.builtin.import_role:
146+
ansible.builtin.include_role:
156147
name: openondemand
157148
tasks_from: jupyter_compute.yml
158149
when: "'openondemand_jupyter' in group_names"
159150

160151
- name: Open OnDemand RStudio node
161-
ansible.builtin.import_role:
152+
ansible.builtin.include_role:
162153
name: openondemand
163154
tasks_from: rstudio_compute.yml
164155
when: "'openondemand_rstudio' in group_names"
165156

166157
- name: Open OnDemand Code Server node
167-
ansible.builtin.import_role:
158+
ansible.builtin.include_role:
168159
name: openondemand
169160
tasks_from: codeserver_compute.yml
170161
when: "'openondemand_codeserver' in group_names"

ansible/portal.yml

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,8 @@
66
become: true
77
gather_facts: true # TODO
88
tasks:
9-
- name: Skip openondemand apps installation in configure mode
10-
ansible.builtin.set_fact:
11-
ood_install_apps: {}
12-
when: appliances_mode == 'configure'
139
- ansible.builtin.import_role:
1410
name: openondemand
15-
tasks_from: main.yml
1611

1712
- hosts: openondemand_desktop:openondemand_matlab
1813
tags:

ansible/roles/dnf_repos/defaults/main.yml

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,107 @@ dnf_repos_gpg_keys:
165165
'9':
166166
path: /etc/pki/rpm-gpg/RPM-GPG-KEY-TurboVNC
167167
key: "{{ dnf_repos_turbovnc_gpg_key }}"
168+
ondemand-web:
169+
'8':
170+
path: /etc/pki/rpm-gpg/RPM-GPG-KEY-ondemand
171+
key: |
172+
-----BEGIN PGP PUBLIC KEY BLOCK-----
173+
Version: GnuPG v2.0.22 (GNU/Linux)
174+
175+
mQENBFqB7y4BCADA2233uSAJC9EG3MM2EmmDjKCDy8Q9w3D1g48/roBUvONLveac
176+
sx+rCSbP9Oc6sRJdxkQwppKKxKTwP5zGUGZto3wacaw2hTVfA7xFUfgcfZn3b0Az
177+
fSTR2FlTnJ35THO1MkVNv/55D+qBOoEhrAGeUdB7TMGp9y+A6eHRYa0UdxY/rccY
178+
xvz2oQOD6BH2s7IzLNUVLOifiu9Nrk213dghKOZjYwWERrpXj/EryuLm7wpKN349
179+
pixk6zP4SIKj0L4HTwMqEcTCAxBKfidmUQ+JILvTRlTCItFPTcXJxqSI6jVA6Iu0
180+
sZlO3XolEVdeGXL0MVjHVIpNZrV7vnTUFWPrABEBAAG0L09uRGVtYW5kIFJlbGVh
181+
c2UgU2lnbmluZyBLZXkgPHBhY2thZ2VzQG9zYy5lZHU+iQE5BBMBAgAjBQJage8u
182+
AhsDBwsJCAcDAgEGFQgCCQoLBBYCAwECHgECF4AACgkQS3L+K5LTF1UQzgf5AQ8Q
183+
Fy6JhxYaa56FHALiYCKJn+YHSbI4uZE6umpnV/14lU2Timw/xwNiH2ndlnl3a8be
184+
NcYPYkX+7T5nWQty7YK3aIEEMeMY/I8Cb0RKaCoJwETbu9u4dKguAy19fj0h0jGC
185+
v0lrBHNWfv572pr+TOcdVP2CFyfHybl6MvWFshM5mUxSeMItSa8KDVaWfZiPHzQe
186+
YrL4ZcWvqLfBK/m8alvggg9zaOIyDKM30lbil66pY/rbveQyGW7SbpxiUh1rNsV4
187+
aQOAVJRQC+uJn44OeTuB9nRR5nFLA70i+MtPbQNd3QiOHxuZN7c4sLkvmQslf1HZ
188+
7XoiYp0GlWMoI+YVXrkBDQRage8uAQgAut5ko4fkPkBfldawTCvTxnxnoa14RVwy
189+
3PcKxhaPmvHzdSjqquYYktgHIIGs8/UOrsFNPdHU6x02v0psaMwL8JX6JqFypPri
190+
YltdXNU/NqlImzfBOkHnAhDiIEI/j34LkEpXhUCmJzeTGAu8wXS3tgx4cHgbfycg
191+
MjmX7QBNghDzC3S+3Kt7wG4pNRlwyFd8r46CL5Yc6+UE9oNvnHdCy3W6OwCYCgXd
192+
919Bsf2Lpy1jGWV3YEiFgYv+pmF0T56vD1Rz+KbIhDEzQ4f/Q0dBZpcjZzQtSJQR
193+
Wh5LX/8JzK0l3PrWOrVmW1GmKQ1DPIkAT2iR35ydgEbi/wuk+izeyQARAQABiQEf
194+
BBgBAgAJBQJage8uAhsMAAoJEEty/iuS0xdVPtUH/16Kd1xX3PSGzOFatNJvfOR5
195+
5oCuVqMLm4sFXdrp0Spnn2B7Dx58jL0slwtWMh6xdtD/CKH/ihnM/um3h5JT0EvE
196+
9XTBfXwOkKgtdxgrHVeoT8gYNaw/0/kIlPavK5QviSNA64qUdFUvtg01FeyKmZ/R
197+
jaRKJZUy+orHYZLo41uj7iGA5Op4gL70ydTnnYFcCb/eLOuGKci1yUzchjxY6YAa
198+
9/ZHhpAqcKsIqZWpzLimLTTH2E43YYVbRcyP9Csfm7qFG8m7RwjXdbquzfkMkujq
199+
weYYi8Av2oajeR3NLoVvCPP2R3yT1YtDCuMRP8Pe4q9gmh7WKwdr38f6/an4VSI=
200+
=uztj
201+
-----END PGP PUBLIC KEY BLOCK-----
202+
'9':
203+
path: /etc/pki/rpm-gpg/RPM-GPG-KEY-ondemand
204+
key: |
205+
-----BEGIN PGP PUBLIC KEY BLOCK-----
206+
207+
mQINBGKraI8BEACzsh07SFbz9B1mo8IzTBUu1ky0vbabaPv8opxpyTKoYJrxozhV
208+
rOOg0wbRywRRFAvqXlSQ8lpQebJ55hR4A9UvpP5X2XoH0BJ7nkiHyndSAPVYJgh8
209+
u0sZ2Jk2tkePEBszIkMe0gm8RUUdh/pMwkIMwGJGH2MMp/UhVxw+xvRWn5BBWalZ
210+
QInbQ5pzMW8LR/j6eLqOCrG2PgPosxBss93ZH5bIcAUyQwlVROyhOQLow9XKVlwm
211+
rb1wa4WMH6j2cZZPvzb40BJP1EmuXGzlbaG7VhMf1lJH71kE3woz3HviQnM/tcAf
212+
qdqdyNARJnMgTlIQQj8vZnp4TRvhXzjeQPjyLQAk6u3xC0NcDTxgxDcRSC70kRVt
213+
oChx35ICVWYchgsKc10do6Twll2w9PmriFFXRyY948XjJ1W/QqfBz2tPZSNurBDH
214+
4PCrrJ6Z/IPq5GkE6PGfD1ayoAGUgNZ8cDat5xpFmdzrei08ETUsw7tD6sLl1q+L
215+
QGSU60z9o8u2joFYujNKemYZ/faAPfbKb0Fj4rUpEvMw8TN3lsisRkwQTgSEzSAS
216+
cjPLjulRDWk5n7nUaofI2gT841qlIcHaoxZXfnz1h80aSJVxp0WLySNDTGBecyik
217+
+yVYPe25ZQ1z/43H+Fdu9joHoteSnBVYM2o4QaHreWP0Rj7bSa8gAj3xuQARAQAB
218+
tDhPbkRlbWFuZCBSZWxlYXNlIFNpZ25pbmcgS2V5IChTSEE1MTIpIDxwYWNrYWdl
219+
c0Bvc2MuZWR1PokCUgQTAQgAPBYhBD1M1+fUvEUmOsETiMKtsZr9d1SYBQJiq2iP
220+
AhsPBQsJCAcCAyICAQYVCgkICwIEFgIDAQIeBwIXgAAKCRDCrbGa/XdUmIPHD/sG
221+
hPf5DShS3mDWvLxPBlmjpaEktX4XQ0UndbY9NE00ydg71A2yhlfMhDqUigE24dTj
222+
ti/cNz/F4xg8HeFVM82ZtS5nBRHHXtVsqHYRoMY712pi8cqvgKJsgqFwKvj2oBTt
223+
vg+HHKF1iPlDwAhyfemDbhvubJ7Y6r1R1ixJ+dH8Fc62BLLLvRnmTxP5hhL5ZkYm
224+
EHyIQGhbb+5IgbDlIb9DMAzncd6Qb3pKWD8lInrM/poWIF1uwS2Pu+lb9eCY4u5L
225+
XJv0UEu47FHVVTGVKFpU98YJzk6hqC5sX/mnoTd9MMzB/qub7zu6zWnrog9s6YnX
226+
rYIxRO7oCjMbjHVs7vzO5T7uEJwrBqFHrVy7f5+nkmV7iw9QkpH3C88AQcXJqRyq
227+
VJh/wPNJpNIwBBXEO+BLCJCvjXY8TiJUCCMXarw8WI2bw39VIth6V+tDwYMkN8ng
228+
W/hVnpbahTh0QMN9LVqg+E0g2KfpgG45u4KQQOlryxEhalpo4RLq6vZwPFcmE5qI
229+
P9MxFF7YDCK2oSL0sfiF8uFyn+kfM8m8NqPbkZ+2WEjlp+BanF6bCpLag9LsRH/h
230+
Grud0L3QKKoYeVUjFSJKX0I4iZq2P5+JFn7oW4pbehsCzyPQdnQdCBZbmgqXCcjv
231+
CBOW2uzosEeOQB44vKB3fPbZiH4tqF2QjSX4txLGnrkCDQRiq2iPARAA15zRtYcu
232+
094X4aaXKhiiutzE9eVfC048MYtESwXas86+CZOSAsWMfQ2v6FCmmSyFt6SFzVEM
233+
Fyb3MK1iHkfO2AfXHplVlVtn5ZWiqcBrTcyPHq4a1KwY+lMTsExp48InWLRKUPm7
234+
NSd7xeKrj4WKi6fWEKT4UZeL81UOirE0YfO9jjTDkMQKsBOuYPJdztTSt5WloECG
235+
Z+kkVo96yXCUAQ5r0M15SLd3nc8KofcyMXxDYKo8XzA4iX8/1qi9kxx/tYN30j6k
236+
Hts4JM7iLHU7JbRKdq9wVeUr4PlIN+kRnaeNAGgPh1Pi3tFjs5f+aHXkdxzUrTfM
237+
89plxqQ0RO3qLzrTBeeeWERMBoNJv3U7qJtyf6or8evpMdu1+jsmT09+v0XvT8vI
238+
lk3rTowEI/9E2bG/L7YrHZPFiMVPXfequqDVerLJAk+o0pg8iFtzTYf6FUhU9veJ
239+
HQNDTZ7Hlpjfx+nGFUs6EEcUXcCfUsUlQcqoqHrX/poAL+Jx/q6mQOrtyFlK3LbA
240+
nfkoP7n+X/WT/ImrDJCxh5E4maKHrT/RRkW3NqF66qEVVo/5QwBwRE2IX+k0DbYP
241+
Ckkbr/R+pbCGkoCqe9Y4xGEKa+uOQEh7k2yE2FzPWVZcYNykL2mjbHVItlDGZfUZ
242+
L+C4ZWc2O/BpB/p/+HE+2NeztiafeqVUV3MAEQEAAYkEbAQYAQgAIBYhBD1M1+fU
243+
vEUmOsETiMKtsZr9d1SYBQJiq2iPAhsOAkAJEMKtsZr9d1SYwXQgBBkBCAAdFiEE
244+
+aTrgAtw8xnYdeOMkEiioF+HaS8FAmKraI8ACgkQkEiioF+HaS8THRAA1tf6HZng
245+
jTnkqrk04plGC9AnFMT9O4/V+Gk4Fi54JD49/mR8Ypvh6mRyxPdqFCnd2hLOQELB
246+
JWo268n4Fjl4WNjAlEsM1cyykj3DEVxGg8CdGW4OtT9MfO22GICwh3aJSurYSGYp
247+
Wse00fCEcwqpP7s/8rGPkiV6CSwCMFW+kq4pb2RwbGrHsc1h5oqfdZXsEAWFmI6v
248+
r16TlWfEnZx0v2A/Zb4wEGNcsCopje5hoWzyolNunr29Z+htUll8ixi4YNUJuz1B
249+
Rsuw7/3h7cS32SevEgLQ8rxnirdPhVISx9m/lm7CJTgyC/KtKs7FN366yyIKHZxS
250+
p7yXg42cXKaikkNrQGerJrBkSKbA2w76tsNwJRGLYCne2s0Vl/GERKcBQ15EeM3d
251+
mA6vuT5c4G/cQ603AbwJjuEbi14b1kPvG7YJEojr7QnoPOeoTnud/IPgvN8YnzMc
252+
QrgfVn14iQMAGNjeCEyjAh/z4sRI4kxMgJnTLcUBPF9of05u6AEEevfQ9WgroLdb
253+
Gs1byuzLvsjNI1GbwJhMluka8l3kWh6QIBOXs7B/32sV0UvugbCfg+ffrZUvyg59
254+
avzuQOm929EBn0p7vDnlHW1Ycn74156jiRv42O44rk+KZbStJ2wyJ1F49yTXUXPF
255+
PUJaXWugbnnhowAW+3b5UJid5YNJ6ez7mMLZDQ/+J7sz/Fx83n9Q1dE9tjdxoAdA
256+
XP7Qn9274UucNrphh3WIZyMYOSXA/haw8KjiF3E8nu5EaF33cfMw3jvzzdjGWBQ3
257+
0aCOwBIFdRsKU27vGGUF6V6ufcp/dNJpE06zNcWLLVsSMhHBwe6qTIs/HgyjzOWH
258+
Svgns87IG2TaOdTr7Nu6Mx119KyNnmRoSTeB0WsSf+gHkGWAK02Yj3RyuufPPFp8
259+
stQdtt6FmPckNCCRu4rbYBH0yz9Xw5DdhcFHy0QDCOBdIZrog7hlS4fnxeqaf9ca
260+
m/aignTsidOqk/eKCyUC+1+U7F3xuM9iYMJmH1tKDQ3ESbrNkEeQzLzyUbgov2lR
261+
/6nbIuKuiTqVa+zq5WWGkvT3FRHRvoKAoEBWP7EjHs9L1Rcd13eGcSyIoZfHjPPP
262+
anPRjuzV9xp2B+y4XiKWtsdAfLYiHs1v7nfKZZbK9mIuoZ5nftGuTaKxWFspF733
263+
rBCa3Vz3O2Jeyg0g8zU6nXl3naMaVCtkOS73oVn4P44ebu+jWok2EtE0owLTmcBQ
264+
KKLxF+xHlaYvuErrKqnjUZFEuE/tPWNVz0/Umt4T7iQvbBGSRFcuDUgQeMktjBIb
265+
UGtVVgGb9BwJxKYqfI1bnzkK73mEKYz2XKtqgBHHp+OkpzvgrUhxuyfHmlRy34dw
266+
WAS7M0V6x6GPiX+zI1M=
267+
=wRIy
268+
-----END PGP PUBLIC KEY BLOCK-----
168269
169270
# from https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage
170271
# see https://www.centos.org/keys/

ansible/roles/openondemand/defaults/main.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,8 +102,9 @@ openondemand_osc_ood_defaults:
102102
ood_auth_openidc: "{{ openondemand_auth_defaults.oidc.ood_auth_openidc if (openondemand_auth | lower) == 'oidc' else none }}"
103103
httpd_auth: "{{ openondemand_auth_defaults[openondemand_auth | lower].httpd_auth }}"
104104

105-
# Use repo file provided by dnf_repos by default
105+
# Use gpgkey and repo file provided by dnf_repos by default:
106106
ood_use_existing_repo_file: true
107+
rpm_repo_key: /etc/pki/rpm-gpg/RPM-GPG-KEY-ondemand
107108

108109
# Apps:
109110
openondemand_code_server_version: 4.102.2
Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
- ansible.builtin.include_tasks:
2+
file: config_changes.yml
3+
4+
# The configure.yml playbook needs vars from Rocky (for nginx) and main if using OIDC auth. However vars_from doensn't take a list.
5+
# include_vars doens't interpolate from role vars, so we use that for main.yml which only requires things we override in the appliance inventory
6+
# and use vars_from for Rocky which requires interpolation from role vars.
7+
# - include_vars:
8+
# file: roles/osc.ood/vars/main.yml
9+
10+
- ansible.builtin.include_role:
11+
name: osc.ood
12+
tasks_from: configure.yml
13+
vars_from: main.yml
14+
public: true
15+
16+
- name: Get GRES information
17+
ansible.builtin.command:
18+
cmd: sinfo --noheader --format "%R %G" # can't use , or : as separator
19+
changed_when: true
20+
register: _openondemand_sinfo_gres
21+
22+
- ansible.builtin.include_role:
23+
name: osc.ood
24+
tasks_from: apps.yml
25+
# vars_from: Rocky.yml
26+
when: ood_apps
27+
28+
- name: Ensure post_tasks dirs exists
29+
ansible.builtin.file:
30+
path: "{{ item }}"
31+
state: directory
32+
mode: "0755"
33+
loop:
34+
# - /etc/ood/config/apps/dashboard/initializers
35+
- /etc/ood/config/locales
36+
- /etc/ood/config/announcements.d
37+
- /etc/ood/config/pun/html
38+
39+
- name: Create dashboard additional config directory
40+
ansible.builtin.file:
41+
path: /etc/ood/config/apps/dashboard/initializers
42+
state: directory
43+
recurse: true
44+
owner: root
45+
mode: o=rwX,go=rX
46+
47+
- name: Create additional shortcuts in Files app
48+
ansible.builtin.template:
49+
src: files_shortcuts.rb.j2
50+
dest: /etc/ood/config/apps/dashboard/initializers/ood.rb
51+
owner: root
52+
mode: o=rw,go=r
53+
when: openondemand_filesapp_paths
54+
55+
- name: Create job template directory
56+
ansible.builtin.file:
57+
path: "/etc/ood/config/apps/myjobs/templates/"
58+
state: directory
59+
recurse: true
60+
owner: root
61+
group: root
62+
mode: o=rwX,go=rX
63+
64+
- name: Copy web page to let users create their home directory
65+
ansible.builtin.copy:
66+
src: missing_home_directory.html
67+
dest: /etc/ood/config/pun/html/missing_home_directory.html
68+
mode: "0644"
69+
70+
- name: Create mapping directory
71+
ansible.builtin.file:
72+
path: /etc/grid-security
73+
state: directory
74+
owner: root
75+
group: apache
76+
mode: u=rwX,g=rX,o=
77+
when: openondemand_mapping_users
78+
79+
- name: Create mapping file
80+
ansible.builtin.template:
81+
dest: /etc/grid-security/grid-mapfile
82+
src: grid-mapfile.j2
83+
owner: root
84+
group: apache
85+
mode: u=rw,g=r,o=
86+
when: openondemand_mapping_users
87+
88+
- name: Create app directories for dashboard links
89+
ansible.builtin.file:
90+
path: /var/www/ood/apps/sys/{{ item.app_name | default(item.name) }}
91+
state: directory
92+
mode: "0755"
93+
loop: "{{ openondemand_dashboard_links }}"
94+
95+
- name: Create app manifests for dashboard links
96+
ansible.builtin.template:
97+
src: dashboard_app_links.yml.j2
98+
dest: /var/www/ood/apps/sys/{{ item.app_name | default(item.name) }}/manifest.yml
99+
mode: "0644"
100+
loop: "{{ openondemand_dashboard_links }}"
101+
102+
# - name: Ensure ondemand-dex is running and active
103+
# service:
104+
# name: ondemand-dex
105+
# enabled: yes
106+
# state: stopped
107+
# when: false
108+
109+
# - name: Copy site images
110+
# copy:
111+
# src: ansible/roles/openondemand/ondemand
112+
# dest: "{{ item }}"
113+
# loop:
114+
# - /var/www/ood/public
115+
# - /usr/share/ondemand-dex/web/themes/
116+
117+
- name: Keyscan login host
118+
ansible.builtin.command:
119+
cmd: "ssh-keyscan {{ openondemand_clusters.slurm.v2.login.host }}"
120+
register: _openondemand_login_key
121+
changed_when: false
122+
123+
- name: Add login hostkeys to known hosts
124+
ansible.builtin.blockinfile:
125+
path: /etc/ssh/ssh_known_hosts
126+
create: true
127+
block: "{{ _openondemand_login_key.stdout_lines | sort | join('\n') }}"
128+
marker: "# {mark} ANSIBLE MANAGED BLOCK: openondemand login host" # allows other tasks to use blockinfile on this file
129+
owner: root
130+
group: root
131+
mode: o=rw,go=r

0 commit comments

Comments
 (0)