Separate slurm_jobscripts from userportal server

Allow running the slurm controller service and userportal in distinct instances.
ComputeCanada · Aug 16, 2023 · 314229a · 314229a
1 parent edb8541
commit 314229a
Show file tree

Hide file tree

Showing 3 changed files with 42 additions and 34 deletions.
diff --git a/bootstrap.sh b/bootstrap.sh
@@ -13,6 +13,7 @@ ENC_CMD="eyaml encrypt -o block --pkcs7-public-key=${PKCS7_KEY}"
     $ENC_CMD -l 'profile::freeipa::server::ds_password' -s $(openssl rand -base64 9)
     $ENC_CMD -l 'profile::freeipa::server::admin_password' -s $(openssl rand -base64 9)
     $ENC_CMD -l 'profile::userportal::server::password' -s $(openssl rand -base64 9)
+    $ENC_CMD -l 'profile::userportal::server::root_api_token' -s $(openssl rand -hex 20)
 ) > /etc/puppetlabs/code/environments/production/data/bootstrap.yaml
 
 # Apply bootstrap classes if any

diff --git a/data/common.yaml b/data/common.yaml
@@ -264,3 +264,4 @@ profile::userportal::server::prometheus_ip: "%{alias('terraform.tag_ip.mgmt.0')}
 profile::userportal::server::prometheus_port: 9090
 profile::userportal::server::db_ip: 127.0.0.1
 profile::userportal::server::db_port: 3306
+profile::userportal::slurm_jobscripts::token: "%{alias('profile::userportal::server::root_api_token')}"
diff --git a/site/profile/manifests/userportal.pp b/site/profile/manifests/userportal.pp
@@ -1,4 +1,5 @@
 class profile::userportal::server (
+  String $root_api_token,
   String $password,
   String $prometheus_ip,
   Integer $prometheus_port,
@@ -116,56 +117,61 @@
     returns     => [0, 1], # ignore error if user already exists
   }
 
-  file { '/etc/slurm/slurm_jobscripts.ini':
-    ensure  => 'file',
-    owner   => 'slurm',
-    group   => 'slurm',
-    mode    => '0600',
-    replace => false,
-    content => @(EOT),
-[slurm]
-spool = /var/spool/slurm
-
-[api]
-host = http://localhost:8001
-script_length = 100000
-|EOT
-  }
-
+  $api_token_command = "echo 'from rest_framework.authtoken.models import Token; Token.objects.filter(user_id=1).update(key='${root_api_token}')' | manage.py shell"
   exec { 'userportal_api_token':
-    command   => 'manage.py drf_create_token root | awk \'{print "token = " $3}\' >> /etc/slurm/slurm_jobscripts.ini',
-    unless    => 'grep -q token /etc/slurm/slurm_jobscripts.ini',
-    require   => File['/etc/slurm/slurm_jobscripts.ini'],
-    subscribe => [
-      File['/etc/slurm/slurm_jobscripts.ini'],
+    command     => Sensitive($api_token_command),
+    subscribe   => [
       Exec['userportal_apiuser'],
     ],
-    notify    => Service['slurm_jobscripts'],
-    path      => [
+    refreshonly => true,
+    path        => [
       '/var/www/userportal',
       '/var/www/userportal-env/bin',
       '/usr/bin',
     ],
   }
 
+  mysql::db { 'userportal':
+    ensure   => present,
+    user     => 'userportal',
+    password => $password,
+    host     => 'localhost',
+    grant    => ['ALL'],
+  }
+}
+
+class profile::userportal::slurm_jobscripts (
+  String $token
+) {
+  $slurm_jobscript_ini = @("EOT")
+    [slurm]
+    spool = /var/spool/slurm
+
+    [api]
+    host = http://localhost:8001
+    script_length = 100000
+    token = ${token}
+    | EOT
+
+  file { '/etc/slurm/slurm_jobscripts.ini':
+    ensure  => 'file',
+    owner   => 'slurm',
+    group   => 'slurm',
+    mode    => '0600',
+    replace => false,
+    notify  => Service['slurm_jobscripts'],
+    content => $slurm_jobscript_ini,
+  }
+
   file { '/etc/systemd/system/slurm_jobscripts.service':
     mode   => '0644',
     source => 'puppet:///modules/profile/userportal/slurm_jobscripts.service',
     notify => Service['slurm_jobscripts'],
   }
 
   service { 'slurm_jobscripts':
-    ensure  => 'running',
-    enable  => true,
-    require => Exec['userportal_api_token'],
-  }
-
-  mysql::db { 'userportal':
-    ensure   => present,
-    user     => 'userportal',
-    password => $password,
-    host     => 'localhost',
-    grant    => ['ALL'],
+    ensure => 'running',
+    enable => true,
   }
 }