Skip to content

Commit 2903223

Browse files
sjpbjovial
sjpb
and
jovial
authored
Support SSSD and optionally LDAP (#438)
* support sssd configuration * make sssd-ldap optional * SSSD PR review tweaks * enable installing sssd in fatimage * install sssd and sssd-ldap packages in stackhpc fatimage * fix sssd being enabled in fatimage * bump CI image * simplify sssd-ldap package installation in fatimage * bump CI image * enable mkhomedir * add sshd role * auto enable ssh passwords if using ldap * actually run sshd role * make sshd config more flexible * add basic_users_override_sssd flag * port PR comment re. basic_users docs * add sssd-ldap package during stackhpc build only * bump CI image * add missing empty sssd group * remove deprecated & empty block_devices group * regularise common groups & everything groups template a bit * bumb CI image * sssd review comments Co-authored-by: Will Szumski <[email protected]> --------- Co-authored-by: Will Szumski <[email protected]>
1 parent a7876a6 commit 2903223

File tree

26 files changed

+188
-10
lines changed

26 files changed

+188
-10
lines changed

‎ansible/.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,10 @@ roles/*
5858
!roles/squid/**
5959
!roles/tuned/
6060
!roles/tuned/**
61+
!roles/sssd/
62+
!roles/sssd/**
63+
!roles/sshd/
64+
!roles/sshd/**
6165
!roles/compute_init/
6266
!roles/compute_init/**
6367
!roles/k3s/

‎ansible/bootstrap.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,15 @@
110110
policy: "{{ selinux_policy }}"
111111
register: sestatus
112112

113+
- hosts: sshd
114+
tags: sshd
115+
gather_facts: no
116+
become: yes
117+
tasks:
118+
- name: Configure sshd
119+
import_role:
120+
name: sshd
121+
113122
- hosts: dnf_repos
114123
become: yes
115124
tasks:

‎ansible/fatimage.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,11 @@
5454
name: freeipa
5555
tasks_from: client-install.yml
5656
when: "'freeipa_client' in group_names"
57+
- name: Install sssd
58+
import_role:
59+
name: sssd
60+
tasks_from: install.yml
61+
when: "'sssd' in group_names"
5762

5863
# - import_playbook: filesystems.yml:
5964
- name: Install nfs packages

‎ansible/iam.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,12 @@
4040
import_role:
4141
name: freeipa
4242
tasks_from: users.yml
43+
44+
- hosts: sssd
45+
become: yes
46+
gather_facts: no
47+
tags: sssd
48+
tasks:
49+
- name: Configure sssd
50+
import_role:
51+
name: sssd

‎ansible/roles/basic_users/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ Role Variables
2424
- An additional key `sudo` may optionally be specified giving a string (possibly multiline) defining sudo rules to be templated.
2525
- Any other keys may present for other purposes (i.e. not used by this role).
2626
- `basic_users_groups`: Optional, default empty list. A list of mappings defining information for each group. Mapping keys/values are passed through as parameters to [ansible.builtin.group](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/group_module.html) and default values are as given there.
27+
- `basic_users_override_sssd`: Optional bool, default false. Whether to disable `sssd` when ensuring users/groups exist with this role. Permits creating local users/groups even if they clash with users provided via sssd (e.g. from LDAP). Ignored if host is not in group `sssd` as well. Note with this option active `sssd` will be stopped and restarted each time this role is run.
2728

2829
Dependencies
2930
------------

‎ansible/roles/basic_users/defaults/main.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,4 @@ basic_users_userdefaults:
77
shell: "{{'/sbin/nologin' if 'control' in group_names else omit }}"
88
basic_users_users: []
99
basic_users_groups: []
10+
basic_users_override_sssd: false

‎ansible/roles/basic_users/tasks/main.yml

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,16 @@
77
label: "{{ item.name }}"
88
when:
99
- "item.state | default('present') == 'absent'"
10-
10+
11+
- name: Stop sssd if required
12+
systemd:
13+
name: sssd
14+
state: stopped
15+
register: _stop_sssd
16+
when:
17+
- "'sssd' in group_names"
18+
- basic_users_override_sssd | bool
19+
1120
- name: Create groups
1221
ansible.builtin.group: "{{ item }}"
1322
loop: "{{ basic_users_groups }}"
@@ -19,6 +28,12 @@
1928
label: "{{ item.name }} [{{ item.state | default('present') }}]"
2029
register: basic_users_info
2130

31+
- name: Restart sssd if required
32+
systemd:
33+
name: sssd
34+
state: started
35+
when: _stop_sssd is changed
36+
2237
- name: Write supplied public key as authorized for SSH access
2338
authorized_key:
2439
user: "{{ item.name }}"

‎ansible/roles/sshd/README.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# sshd
2+
3+
Configure sshd.
4+
5+
## Role variables
6+
7+
- `sshd_password_authentication`: Optional bool. Whether to enable password login. Default `false`.
8+
- `sshd_conf_src`: Optional string. Path to sshd configuration template. Default is in-role template.
9+
- `sshd_conf_dest`: Optional string. Path to destination for sshd configuration file. Default is `/etc/ssh/sshd_config.d/10-ansible.conf` which overides `50-{cloud-init,redhat}` files, if present.

‎ansible/roles/sshd/defaults/main.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
sshd_password_authentication: false
2+
sshd_conf_src: sshd.conf.j2
3+
sshd_conf_dest: /etc/ssh/sshd_config.d/10-ansible.conf

‎ansible/roles/sshd/handlers/main.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
- name: Restart sshd
2+
systemd:
3+
name: sshd
4+
state: restarted

‎ansible/roles/sshd/tasks/configure.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
- name: Template sshd configuration
2+
# NB: If parameters are defined multiple times the first value wins;
3+
# The default /etc/ssh/sshd_config has
4+
# Include /etc/ssh/sshd_config.d/*.conf
5+
# early on, which is generally held to be the correct approach, so adding
6+
# values to the end of that file won't work
7+
template:
8+
src: "{{ sshd_conf_src }}"
9+
dest: "{{ sshd_conf_dest }}"
10+
owner: root
11+
group: root
12+
mode: u=rw,go=
13+
validate: sshd -t -f %s
14+
notify:
15+
- Restart sshd

‎ansible/roles/sshd/tasks/main.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
- import_tasks: configure.yml

‎ansible/roles/sshd/templates/sshd.conf.j2

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# {{ ansible_managed }}
2+
PasswordAuthentication {{ 'yes' if sshd_password_authentication | bool else 'no' }}

‎ansible/roles/sssd/README.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# sssd
2+
3+
Install and configure [sssd](https://sssd.io/docs/introduction.html).
4+
5+
6+
## Role variables
7+
8+
The only required configuration is to create a [sssd.conf](https://www.mankier.com/5/sssd.conf) template at the location specified by `sssd_conf_src`.
9+
10+
- `sssd_packages`: Optional list. Packages to install.
11+
- `sssd_ldap_install`: Optional bool. Whether to install packages enabling SSSD to authenticate against LDAP. Default `false`.
12+
- `sssd_ldap_packages`: Optional list. Packages to install when using `sssd_ldap_install`.
13+
- `sssd_enable_mkhomedir`: Optional bool. Whether to enable creation of home directories on login. Default `false`.
14+
- `sssd_mkhomedir_packages`: Optional list. Packages to install when using `sssd_enable_mkhomedir`.
15+
- `sssd_conf_src`: Optional string. Path to `sssd.conf` template. Default (which must be created) is `{{ appliances_environment_root }}/files/sssd.conf.j2`.
16+
- `sssd_conf_dest`: Optional string. Path to destination for `sssd.conf`. Default `/etc/sssd/sssd.conf`.
17+
- `sssd_started`: Optional bool. Whether `sssd` service should be started.
18+
- `sssd_enabled`: Optional bool. Whether `sssd` service should be enabled.

‎ansible/roles/sssd/defaults/main.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
sssd_packages:
2+
- sssd-common
3+
sssd_install_ldap: false
4+
sssd_ldap_packages:
5+
- sssd-ldap
6+
sssd_enable_mkhomedir: false
7+
sssd_mkhomedir_packages:
8+
- oddjob-mkhomedir
9+
sssd_conf_src: "{{ appliances_environment_root }}/files/sssd.conf.j2"
10+
sssd_conf_dest: /etc/sssd/sssd.conf
11+
sssd_started: true
12+
sssd_enabled: true

‎ansible/roles/sssd/handlers/main.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
- name: Restart sssd
2+
systemd:
3+
name: sssd
4+
state: restarted
5+
when: sssd_started | bool

‎ansible/roles/sssd/tasks/configure.yml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
- name: Manage sssd.conf configuration
2+
template:
3+
src: "{{ sssd_conf_src }}"
4+
dest: "{{ sssd_conf_dest }}"
5+
owner: root
6+
group: root
7+
mode: u=rw,go=
8+
notify: "Restart sssd"
9+
10+
- meta: flush_handlers
11+
12+
- name: Ensure sssd service state
13+
systemd:
14+
name: sssd
15+
state: "{{ 'started' if sssd_started | bool else 'stopped' }}"
16+
enabled: "{{ sssd_enabled | bool }}"
17+
18+
- name: Get current authselect configuration
19+
command: authselect current --raw
20+
changed_when: false
21+
failed_when:
22+
- _authselect_current.rc != 0
23+
- "'No existing configuration detected' not in _authselect_current.stdout"
24+
register: _authselect_current # stdout: sssd with-mkhomedir
25+
26+
- name: Configure nsswitch and PAM for SSSD
27+
command: "authselect select sssd --force{% if sssd_enable_mkhomedir | bool %} with-mkhomedir{% endif %}"
28+
when: "'sssd' not in _authselect_current.stdout"

‎ansible/roles/sssd/tasks/install.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
- name: Ensure sssd packages are installed
2+
dnf:
3+
name: "{{ sssd_packages + sssd_ldap_packages if (sssd_install_ldap | bool) else [] }}"
4+
5+
- name: Control if sssd should start on boot
6+
# Needs to be done here to prevent starting after image build, is enabled by default
7+
systemd:
8+
name: sssd
9+
enabled: "{{ sssd_enabled | bool }}"
10+
11+
- name: Ensure mkhomedir packages are installed if required
12+
dnf:
13+
name: "{{ sssd_mkhomedir_packages }}"

‎ansible/roles/sssd/tasks/main.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
- import_tasks: install.yml
2+
- import_tasks: configure.yml

‎environments/.stackhpc/inventory/extra_groups

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,7 @@ compute
3131
[squid:children]
3232
# Install squid into fat image
3333
builder
34+
35+
[sssd:children]
36+
# Install sssd into fat image
37+
builder

‎environments/.stackhpc/inventory/group_vars/builder.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
#update_enable: false # Can uncomment for speed debugging non-update related build issues
2+
sssd_install_ldap: true # include sssd-ldap package in fatimage
13
# update_enable: false # Can uncomment for speed debugging non-update related build issues
24

35
# Uncomment below to use CI pulp servers

‎environments/.stackhpc/terraform/cluster_image.auto.tfvars.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"cluster_image": {
3-
"RL8": "openhpc-RL8-250108-1703-e515b902",
4-
"RL9": "openhpc-RL9-250108-1703-e515b902"
3+
"RL8": "openhpc-RL8-250109-1444-ecea8219",
4+
"RL9": "openhpc-RL9-250109-1444-ecea8219"
55
}
66
}

‎environments/common/inventory/group_vars/all/sshd.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
sshd_password_authentication: "{{ sssd_install_ldap | default(false) | bool }}"

‎environments/common/inventory/group_vars/builder/defaults.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,6 @@ squid_cache_disk: 0 # just needs to be defined
2222
squid_cache_mem: 0
2323
tuned_started: false
2424
tuned_enabled: false
25+
sssd_started: false
26+
sssd_enabled: false
2527
appliances_mode: build

‎environments/common/inventory/groups

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,6 @@ login
1313
control
1414
compute
1515

16-
[eessi:children]
17-
# Hosts on which EESSI stack should be configured
18-
1916
[hpctests:children]
2017
# Login group to use for running mpi-based testing.
2118
login
@@ -79,9 +76,6 @@ cluster
7976
# Hosts to install firewalld on - see ansible/roles/filewalld
8077
fail2ban
8178

82-
[block_devices]
83-
# Superset of hosts to configure filesystems on - see ansible/roles/block_devices/README.md
84-
8579
[basic_users]
8680
# Add `openhpc` group to add slurm users via creation of users on each node.
8781

@@ -118,12 +112,18 @@ freeipa_client
118112
[cuda]
119113
# Hosts to install NVIDIA CUDA on - see ansible/roles/cuda/README.md
120114

115+
[eessi]
116+
# Hosts on which EESSI stack should be configured
117+
121118
[resolv_conf]
122119
# Allows defining nameservers in /etc/resolv.conf - see ansible/roles/resolv_conf/README.md
123120

124121
[proxy]
125122
# Hosts to configure http/s proxies - see ansible/roles/proxy/README.md
126123

124+
[manila]
125+
# Hosts to configure for manila fileshares
126+
127127
[persist_hostkeys]
128128
# Hosts to persist hostkeys for across reimaging. NB: Requires appliances_state_dir on hosts.
129129

@@ -136,6 +136,12 @@ freeipa_client
136136
[ansible_init]
137137
# Hosts to run linux-anisble-init
138138

139+
[sssd]
140+
# Hosts to configure sssd on
141+
142+
[sshd]
143+
# Hosts where the OpenSSH server daemon should be configured
144+
139145
[compute_init]
140146
# EXPERIMENTAL: Compute hosts to enable joining cluster on boot on
141147

‎environments/common/layouts/everything

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ cluster
6060
# Hosts to install NVIDIA CUDA on - see ansible/roles/cuda/README.md
6161

6262
[eessi:children]
63+
# Hosts on which EESSI stack should be configured
6364
openhpc
6465

6566
[resolv_conf]
@@ -83,9 +84,15 @@ openondemand
8384
# Hosts to run TuneD configuration
8485

8586
[ansible_init:children]
86-
# Hosts to run ansible-init
87+
# Hosts to run linux-anisble-init
8788
cluster
8889

90+
[sssd]
91+
# Hosts to configure sssd on
92+
93+
[sshd]
94+
# Hosts where the OpenSSH server daemon should be configured
95+
8996
[compute_init:children]
9097
# EXPERIMENTAL: Compute hosts to enable joining cluster on boot on
9198
compute

0 commit comments

Comments
 (0)