Skip to content

Give caas azimuth user sudo #383

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 12 commits into from
Mar 27, 2024
Merged

Give caas azimuth user sudo #383

merged 12 commits into from
Mar 27, 2024

Conversation

sjpb
Copy link
Collaborator

@sjpb sjpb commented Mar 27, 2024

For the caas environment:

  • The user's ssh key is only injected for the azimuth user (not rocky)
  • The deploy key is only injected for the rocky user
  • The azimuth user can now login to the control node
  • The azimuth user has passwordless sudo on all nodes
  • The azimuth user is permitted to ssh into compute nodes even without jobs running

Note that:

  • The azimuth user is setup via the basic_users role instead of cloud-init as ssh keys need to be created on a shared $HOME and propagated across the cluster.
  • To allow the azimuth user to login to the control node, the default shell logic in the basic_users role is overriden and NFS configuration is modified so the control node has /home mounted.

@sjpb
Copy link
Collaborator Author

sjpb commented Mar 27, 2024

Checks using Azimuth user:

  • can ssh into compute and sudo
  • can ssh into control and sudo
  • can sudo on login

@sjpb sjpb marked this pull request as ready for review March 27, 2024 12:31
@sjpb sjpb requested a review from a team as a code owner March 27, 2024 12:31
Copy link
Member

@sd109 sd109 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

It would be good to also update the Azimuth user docs here to reflect these changes.

@sjpb
Copy link
Collaborator Author

sjpb commented Mar 27, 2024

Redone checks after merge from main changed image.

@sjpb sjpb merged commit 5f88633 into main Mar 27, 2024
@sjpb sjpb deleted the feat/azi-sudo branch March 27, 2024 15:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants