chore: update file permissions and paths for Slurm configuration file…

…s and directories.

.github/workflows/kvm-test.yaml

@@ -42,9 +42,6 @@
         - name: Check hosts
           run: |
             cat /etc/hosts
-        - name: Kill any process that helds the lock
-          run: |
-            sudo killall apt apt-get
 
         - name: Extract Network Information
           run: |

roles/slurm/defaults/main.yml

@@ -6,6 +6,8 @@ slurmd_enabled: false
 slurmctld_enabled: false
 slurmdbd_enabled: false
 
+SlurmConfigFileDIr: /etc/slurm-llnl
+
 slurm_config:
   ClusterName: cluster
   # slurmctld options

roles/slurm/tasks/main.yaml

@@ -16,7 +16,7 @@
 - name: Ensure that slurm configuration directory exists
   become: true
   ansible.builtin.file:
-    path: /etc/slurm
+    path: "{{ SlurmConfigFileDIr }}"
     state: directory
     mode: "0755"
     owner: root
@@ -26,10 +26,10 @@
   become: true
   ansible.builtin.template:
     src: templates/slurm.conf
-    dest: /etc/slurm/slurm.conf
+    dest: "{{ SlurmConfigFileDIr }}/slurm.conf"
     owner: root
     group: root
-    mode: "0444"
+    mode: "0755"
   register: _slurm_config
 
 - name: Install extra execution host configs
@@ -40,7 +40,7 @@
       ConstrainCores=yes
       ConstrainRAMSpace=yes
       ConstrainSwapSpace=yes
-    dest: /etc/slurm/cgroup.conf
+    dest: "{{ SlurmConfigFileDIr }}/cgroup.conf"
     owner: root
     group: root
     mode: "0444"

roles/slurm/tasks/slurm_exporter.yaml

@@ -1,6 +1,7 @@
 ---
 - name: Install golang
   ansible.builtin.include_tasks: golang.yaml
+
 - name: Check that the slurm exporter binary exists
   ansible.builtin.stat:
     path: /usr/local/bin/prometheus_slurm_exporter

roles/slurm/tasks/slurmctld.yaml

@@ -1,22 +1,28 @@
 ---
+# Must be writable by user SlurmUser.
+# The file must be accessible by the primary and backup control machines.
 - name: Ensure slurm state directory exists
   become: true
   ansible.builtin.file:
     path: "{{ slurm_config.StateSaveLocation }}"
     state: directory
-    mode: "0700"
+    mode: "0755"
     owner: slurm
     group: slurm
 
+# Must be writable by user SlurmUser.
+# The file must be accessible by the primary and backup control machines.
 - name: Ensure slurm log directory exists
   become: true
   ansible.builtin.file:
     path: "{{ slurm_config.SlurmctldLogFile | dirname }}"
     state: directory
-    mode: "0700"
+    mode: "0755"
     owner: slurm
     group: slurm
 
+# Must be writable by user root. Preferably writable and removable by SlurmUser.
+# The file must be accessible by the primary and backup control machines.
 - name: Ensure slurm pid directory exists
   become: true
   ansible.builtin.file:
@@ -33,7 +39,7 @@
       [Unit]
       Description=Slurm controller daemon
       After=network.target munge.service
-      ConditionPathExists=/etc/slurm/slurm.conf
+      ConditionPathExists={{ SlurmConfigFileDIr }}/slurm.conf
 
       [Service]
       Type=forking

roles/slurm/tasks/slurmd.yaml

@@ -1,4 +1,6 @@
 ---
+# Permissions must be set to 755 so that job scripts can be executed from this directory.
+# A distinct file must exist on each compute node.
 - name: Create slurm spool directory
   become: true
   ansible.builtin.file:
@@ -8,6 +10,8 @@
     mode: "0755"
     state: directory
 
+# Must be writable by user root.
+# A distinct file must exist on each compute node.
 - name: Create slurm log directory
   become: true
   ansible.builtin.file:
@@ -17,6 +21,8 @@
     mode: "0755"
     state: directory
 
+# Must be writable by user root.
+# A distinct file must exist on each compute node.
 - name: Ensure slurm pid directory exists
   become: true
   ansible.builtin.file:
@@ -33,7 +39,7 @@
       [Unit]
       Description=Slurm node daemon
       After=network.target munge.service remote-fs.target
-      ConditionPathExists=/etc/slurm/slurm.conf
+      ConditionPathExists={{ SlurmConfigFileDIr }}/slurm.conf
 
       [Service]
       Type=forking

roles/slurm/tasks/slurmdbd.yaml

@@ -1,13 +1,15 @@
 ---
+# Must be writable by user SlurmUser.
 - name: Ensure slurmdbd log directory exists
   become: true
   ansible.builtin.file:
     path: "{{ slurmdbd_config.LogFile | dirname }}"
     state: directory
-    mode: "0700"
+    mode: "0755"
     owner: slurm
     group: slurm
 
+# Must be writable by user SlurmUser.
 - name: Ensure slurm pid directory exists
   become: true
   ansible.builtin.file:
@@ -17,11 +19,15 @@
     owner: slurm
     group: slurm
 
+# This file should be only on the computer where SlurmDBD executes
+# and should only be readable by the user which executes SlurmDBD (e.g. "slurm").
+# This file should be protected from unauthorized access since
+# it contains a database password
 - name: Install slurmdbd.conf
   become: true
   ansible.builtin.template:
     src: templates/slurmdbd.conf
-    dest: /etc/slurm/slurmdbd.conf
+    dest: "{{ SlurmConfigFileDIr }}/slurmdbd.conf"
     owner: slurm
     group: slurm
     mode: "0600"
@@ -34,7 +40,7 @@
       [Unit]
       Description=Slurm DBD accounting daemon
       After=network.target munge.service
-      ConditionPathExists=/etc/slurm/slurmdbd.conf
+      ConditionPathExists={{ SlurmConfigFileDIr }}/slurmdbd.conf
 
       [Service]
       Type=forking