diff --git a/.gitignore b/.gitignore index 426e8b7e0..2c54dfbba 100644 --- a/.gitignore +++ b/.gitignore @@ -4,9 +4,10 @@ *.md.html *.vagrant *.pydevproject +*.pyc *.retry *.swp -.vault_pass.txt +.vault_pass.txt* documentation/.~lock.UMCG Research IT HPC cluster technical design.docx# promtools/results/* roles/hpc-cloud diff --git a/callback_plugins/homsaplog.py b/callback_plugins/homsaplog.py new file mode 100644 index 000000000..f63160e88 --- /dev/null +++ b/callback_plugins/homsaplog.py @@ -0,0 +1,69 @@ +''' +callback: homsaplog +type: stdout +short_description: Homo sapiens friendly formatted output. +description: Use this callback to sort though extensive debug output. +''' + +from __future__ import (absolute_import, division, print_function) +from ansible.plugins.callback.default import CallbackModule as CallbackModule_default +from ansible.plugins.callback import CallbackBase +try: + # Ansible 2.3 + from ansible.vars import strip_internal_keys +except ImportError: + try: + # Anisble2.4 + from ansible.vars.manager import strip_internal_keys + except ImportError: + # Ansible 2.5 + from ansible.vars.clean import strip_internal_keys +try: + import simplejson as json +except ImportError: + import json +import sys +reload(sys).setdefaultencoding('utf-8') + +__metaclass__ = type + +class CallbackModule(CallbackModule_default): # pylint: disable=too-few-public-methods,no-init + ''' + Override for the default callback module. + + Render std err/out outside of the rest of the result which it prints with + indentation. + ''' + CALLBACK_VERSION = 2.0 + CALLBACK_TYPE = 'stdout' + CALLBACK_NAME = 'homsaplog' + + def _dump_results(self, result, indent=4, sort_keys=True, keep_invocation=False): + '''Return the text to output for a result.''' + + if result.get('_ansible_no_log', False): + return json.dumps(dict(censored= + "The output has been hidden due to the fact that 'no_log: true' was specified for this result.")) + + # All result keys starting with _ansible_ are for internal use only, + # so remove them from the result before we output anything. + reformatted_result = strip_internal_keys(result) + + # remove invocation unless specifically wanting it + if not keep_invocation and self._display.verbosity < 3 and 'invocation' in result: + del reformatted_result['invocation'] + + # remove diff information from screen output + if self._display.verbosity < 3 and 'diff' in result: + del reformatted_result['diff'] + + # remove exception from screen output + if 'exception' in reformatted_result: + del reformatted_result['exception'] + + output = json.dumps(reformatted_result, indent=indent, ensure_ascii=False, sort_keys=sort_keys) + output = output.replace('\\r\\n\",', '",') + output = output.replace('\\r\\n', "\n\t") + output = output.replace('\\n\",', '",') + output = output.replace('\\n', "\n\t") + return output diff --git a/cinder-controller.yml b/cinder-controller.yml deleted file mode 100644 index 2ac183afc..000000000 --- a/cinder-controller.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -- hosts: all - name: Dummy to gather facts - tasks: [] - -- hosts: cinder-controller - become: True - roles: - - hpc-cloud/roles/cinder-controller diff --git a/cinder-storage.yml b/cinder-storage.yml deleted file mode 100644 index 577a2fdd5..000000000 --- a/cinder-storage.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -- hosts: all - name: Dummy to gather facts - tasks: [] - -- hosts: cinder-storage - become: True - roles: - - hpc-cloud/roles/cinder-storage diff --git a/cluster.yml b/cluster.yml index 7da05e880..c8ad37a9c 100644 --- a/cluster.yml +++ b/cluster.yml @@ -1,9 +1,41 @@ --- -- name: Sign host keys of all cluster hosts. +- name: Sanity checks before we start. + hosts: all + pre_tasks: + - name: Verify Ansible version meets requirements. + assert: + that: "ansible_version.full | version_compare('2.4', '>=')" + msg: 'You must update Ansible to at least 2.4.x to use this playbook.' + +- import_playbook: local_admin_users.yml + +- name: Install roles needed for all virtual cluster components. hosts: all roles: + - logins - ssh_host_signer - ssh_known_hosts + tasks: + - cron: + # + # Silly workaround for bug in interaction dbus <-> logind + # Need DBus 1.11.10 for a fix, but CentOS 7.6 is stuck on dbus 1.10.24. + # + name: Restart systemd-logind + minute: "/10" + user: root + job: /bin/systemctl restart systemd-logind + cron_file: restart_logind + become: true + +- name: Mount the ceph volume + hosts: + - compute-vm + - sys-admin-interface + - deploy-admin-interface + become: True + roles: + - mount-volume - name: Install roles needed for all virtual cluster components except jumphosts. hosts: cluster @@ -14,6 +46,8 @@ - ldap - node_exporter - cluster + - resolver + - shared_storage - name: Install ansible on admin interfaces (DAI & SAI). hosts: @@ -46,18 +80,21 @@ - hosts: slurm become: true roles: + - slurm - prom_server - cadvisor - - slurm + vars: + # These variables are needed by the mariadb role. + # Which is a depencency of the slurm role. + # See roles/slurm/meta/main.yml + hostname_node0: "{{ ansible_hostname }}" + ip_node0: "{{ ansible_default_ipv4['address'] }}" - name: Install virtual compute nodes hosts: compute-vm become: true tasks: roles: - - compute-vm - - isilon - - datahandling - slurm-client - name: Install User Interface (UI) @@ -66,19 +103,5 @@ tasks: roles: - slurm_exporter - - user-interface - - datahandling - - isilon - slurm-client - -- name: Export /home on NFS server. - hosts: user-interface:&talos-cluster - roles: - - nfs_home_server - -- name: Mount /home on NFS clients. - hosts: compute-vm&talos-cluster - roles: - - nfs_home_client - -- import_playbook: users.yml +... diff --git a/documentation/Gearshift_technical_design.md b/documentation/Gearshift_technical_design.md index de7334476..5c895e28b 100644 --- a/documentation/Gearshift_technical_design.md +++ b/documentation/Gearshift_technical_design.md @@ -103,7 +103,7 @@ Figure 4. Network design for gs-compute[0-9] node Figure 5. Network design for gs-vcompute[0-9] virtual compute node - ![](./media/media/image6.jpg) + ![](./media/media/image6a.jpg) ### Compute cluster design diff --git a/documentation/media/media/image6a.jpg b/documentation/media/media/image6a.jpg new file mode 100644 index 000000000..a7820eca1 Binary files /dev/null and b/documentation/media/media/image6a.jpg differ diff --git a/gearshift_hosts.ini b/gearshift_hosts.ini index 07a7483d1..689b94092 100644 --- a/gearshift_hosts.ini +++ b/gearshift_hosts.ini @@ -1,43 +1,3 @@ -[databases] -gs-openstack -gs-compute10 -gs-compute11 - -[keystone] -gs-openstack - -[glance-controller] -gs-openstack - -[heat] -gs-openstack - -[horizon] -gs-openstack - -[rabbitmq] -gs-openstack -gs-compute10 -gs-compute11 - -[memcached] -gs-openstack - -[neutron-controller] -gs-openstack physical_interface_mappings=provider:enp130s0f0 - -[nova-controller] -gs-openstack - -[cinder-controller] -gs-openstack - -[cinder-storage] -gs-compute[01:11] storage_volume=/dev/sdb - -[nova-compute] -gs-compute[01:11] physical_interface_mappings=provider:enp130s0f0 - [jumphost] airlock @@ -68,7 +28,3 @@ administration [gearshift-cluster:children] cluster jumphost - -[metal] -gs-openstack -gs-compute[01:11] diff --git a/glance-controller.yml b/glance-controller.yml deleted file mode 100644 index 4d307f798..000000000 --- a/glance-controller.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -- hosts: all - name: Dummy to gather facts - tasks: [] - -- hosts: glance-controller - become: True - roles: - - hpc-cloud/roles/glance-controller diff --git a/group_vars/administration.yml b/group_vars/administration.yml new file mode 100644 index 000000000..abdea6dcb --- /dev/null +++ b/group_vars/administration.yml @@ -0,0 +1,3 @@ +--- + +volume_mount_point: "/apps" diff --git a/group_vars/all/vars.yml b/group_vars/all/vars.yml index caee5db9e..1a25ad9e6 100644 --- a/group_vars/all/vars.yml +++ b/group_vars/all/vars.yml @@ -5,4 +5,135 @@ ssh_host_signer_ca_private_key: "{{ ssh_host_signer_ca_keypair_dir }}/hpc-ca" ssh_host_signer_key_types: '.*(rsa|ed25519).*' ssh_host_signer_hostnames: "{{ ansible_fqdn }},{{ ansible_hostname }}{% for host in groups['jumphost'] %},{{ host }}+{{ ansible_hostname }}{% endfor %}" spacewalk_server_url: 'http://spacewalk.hpc.rug.nl/XMLRPC' +slurm_table_name: "{{ stack_prefix }}_slurm_accounting" +# +# Configure allowed network ports for geerlingguy.firewall role +# +firewall_allowed_tcp_ports: + - '22' # SSH +# +# Local user account specs. +# Note: +# * all local users are listed here. +# * In ../[name]-cluster/vars.yml we list which users are created locally on which cluster as regular and/or admin users. +# * Never ever change nor recycle a UID value here unless you are in for a surprise... +# +auth_users: + pieter: + comment: 'Pieter Neerincx' + uid: 1001 + pub_keys: | + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCdOt9U8m3oa/ka8vRTOWxU9uh13hR9F5FoW7SRbrQMWX3XYCEF1mFSTU0WHqYlkOm5atbkqRnR2WUOuG2YjCDJ6KqvpYGjITqHilBCINkWuXozoT5HkGbMtcN1nYDh4b+lGhg3ttfTBKBPusLz0Mca68EL6MjmSsgbRSIceNqFrfbjcc/YhJo7Kn769RW6W/ToClVHNHqgC47ZGXDc5acUrcfiaPNFSlyUjqCMKyO7sGOm/o4TTLffznH4A4iNn+/IX+7dGZRlwcmPjsBlpMk8zjQQqDE6l/UykbwKgYBJRO02PeNg3bqDAwSGR5+e4raJ3/mN3tkQqC/cAD3h4eWaRTBJdnLltkOFFeXux4jvuMFCjLYslxHK/LH//GziarA0OQVqA+9LWkwtLx1rKtNW6OaZd45iandwUuDVzlbADxwXtqjjnoy1ZUsAR83YVyhN/fqgOe2i34Q48h27rdkwRwAINuqnoJLufaXyZdYi4QintKOScp3ps/lSXUJq+zn7yh54JCz2l/MhDNUBpBWvZevJTXxqQBszAp5gv0KE2VuPOyrmzo+QeBxKqglMSonguoVolfb9sEYT5Xhu1zR6thRtoBT813kzpeVSzMUAr/KOD+ILSjWKUNT0JuiCXsEDD7Zqx/kspTsHpi/+2irAdcXgAEA+fiJqxsNfV4cpQw== pneerincx + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBzwniHWpMcGx0Pj3rZvXuaJbZa+iNbNpIhuARXW/GV0 pneerincx ED25519 + gerben: + comment: 'Gerben van der Vries' + uid: 1002 + pub_keys: | + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCUfwAhBD4vCDYgsr04Kxn1e+vIcx7EzOEJrwi4Bv1Fc329TAifMTLeXXjPlehNvDvxq1Eb6I0v0CA01OwtD2QH+jnKGK7/RXwOfKHZQDsfZ1qL725So8z2rLfTOiIBn01zwSZTPoMC0NoDEj1H7RUpuSTSWazRmZJAi4S9aWU7DK+aWp0vR4UzvxWNFuzhhSJPOrHBx0O6st67oVRyhhIFo67dIfgI/fDwuT7+hAfAzGtuWAW1SI33ucDtaSSs3CT6ndPIU1jzRwrK/Xoq2vzyso6ptj9N/qJfauVUtwhQs//9hGjIP7H2m4maUDR60qDveUy4QNbRoJQuT28FrZxdYjEWyU7E3/yuBSX5Lggk9GuolpGBTj3EDLth0LUsB/hjjGNSebNL/pF5wQR9Usu9omXf4f3dPfU/X0SaWjeY1ukU4saRefn9FIu1ZV3w6TQUybM/2ZcHzbS2JDieirMTZ2uGUVZyAX4TID40Pc84bcFbfQULkqBGPmp2X3rrfJgg8GmmX92qT/OEEPQ6tsA909dxvXGMYzb/7B5MjiAjdkhhIlRzjFz8zy0dkTAMopxwHPI4Fr1z/LhP8Or7pv31HfG/RIW8pOcanvvRRzqoSohDrfxobzczce42S/qrD0sE2gQdwbnAh0JlPmB7erSrqhxEjw0pHXd8CWx4yH3oJQ== gvdvries + marieke: + comment: 'Marieke Bijlsma' + uid: 1003 + pub_keys: | + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDb8ulPLVGL78KJ8Egg7i2V9JLsge4m4+G6kdCuX7p7T7WRFH54DjaBl52UnkgbuTML/2r6c1gk3pXF2wlOtyHKqhD4AyvY1l/NyLSn1kkgY3XaWp64pFmmEydqOOrPX6L9cMGEyPjnfjr/GWbihzFn7E9Hc0kkp7CPbbdAlmwnKTk1m87CtKHVVV7rg7t7tI+pwoBhAGq1KpwxvNyKQT9Duwo+0eP/xZPZ/b12j7edxjjgpEtV+mCldsbXS+JyMVAScJXYV6TYcSyZhNhLnhzZIikjvV8/LcFxt4sURMeWLkiw3EqQOpDazJT6p6zo0KFfglvYG7ps8ijsnYuz4BkvMGx5bJQZVT4RdzQASisEUhJY1t0ZLGfs4bix2yMNmwCkypNZq72G2p/e2A9n1NhVSyOXfzHonQBFbL5xUX/1PNKXt027wTCbnl0OA/gLdez0NeanRzVjfDJGLOueC93rAJRIAWk+UOUBWAmHvL7XdnrgPq2puxk3sKCijUgxEkh1xqgMST5MTq3DMzese4jeuAQErhs5WnkOiythn4i4ydJ0oUwAjZhSFnGBSzol0Iar6chxfsp2U/pcl97QKXGLXkIvlZ7vMtYdbxopJ8uYQaOdkDycU1upR6pylZ6LnP8mF+iTqcHry4rmQ5rp46m2L5Cbp3eJZ7LFPXTVLUvWWw== mbijlsma + egon: + comment: 'Egon Rijpkema' + uid: 1004 + pub_keys: | + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKUBdTEHUj6MxvfEU7KcI+UPAvqJ9jGJ7hHm3e7XFTb9 egon@egon-pc + morris: + comment: 'Morris Swertz' + uid: 1005 + pub_keys: | + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDfKxBNTqlsoTt1DloXbsRDqUyZgYbAGFsSOKhkHfjTD7zotloUwsd7388J/Ip9dOE5xPySWMSqmjcY8FLYIsEnKaC2LKJya6ck0sOrW+kynV+H9VxLsdnErw5bh8Uga3cGeHX+NKRw9dyNkvFB5B690PidBmSXRRTvXVUBvUeYAAdaoVGSQFtgV/lri2ojWR0yVpy2oCqI/eoXO13NJZS8hyoMDTI1QmnuqarNPIIvYmrAr/bO0fNJuzLqzoAcfw6I4rOw/iE8Zuo2Tl9Erjh1J9nJ91Q+78/VY1H7etltNZe4zxtipaB0HfjkHmhTW2xNMNi5D9FkzHbPhlpShzwsajP0xRpQ8JIgsOli/OHnVU0Mzd6WQf43CliNQMj5Qh50TUYdd0IW0ypjz/h2QEmh560R0NHbvRJ6BDHACceszAMPQjj4zlJLxZJejQ2GijWtvL2Yq2XyVlE7rPH3GA1x3Fy29yBNrgkWsH5CKLMudqBiQ6Js9rHJwQx/WjMA6hLiNqxbHW8t5UHNA4C/tppT12qLWvQkAUUOh9ij/aRnT69V4DlZ/nfbtcJWSjiIToCX++GATm1JrlmzGYoqZy5OMGp5SIdd6+CT+D8E01q9nZYkWokT2EeL3r6I1b8CwIVpmDb5cx6d60tOLjh09jeQMc0PcxeRs6Jo6lQj3L4sZw== m.a.swertz@rug.nl + roan: + comment: 'Roan Kanninga' + uid: 1006 + pub_keys: | + # Revoked: key format not compliant with requirements. + wim: + comment: 'Wim Nap' + uid: 1007 + pub_keys: | + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEY6mVTXsbXOfN5FSYvTMgK8JnODeR7NB50Ilvz3eDd9 w.k.nap + ger: + comment: 'Ger Strikwerda' + uid: 1008 + pub_keys: | + ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBDvx1ebTndL/HitD30uNpvESXWUAxT3j0e0CzrBUZ8fHDv+vZTbWBRtWbnLgCnVDPa3GclA1lpnvJD9JBjBhUa8= ger@ger-pc + robin: + comment: 'Robin Teeninga' + uid: 1009 + pub_keys: | + # Revoked: key format not compliant with requirements. + + kees: + comment: 'Kees Visser' + uid: 1010 + pub_keys: | + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGbGIEjuURXEI2rPUzLzQSsH/OvZJQwCPFO7w0Uls9Xy stealth@operator + + gvdvries: + comment: 'Gerben van der Vries' + uid: 1011 + pub_keys: | + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCUfwAhBD4vCDYgsr04Kxn1e+vIcx7EzOEJrwi4Bv1Fc329TAifMTLeXXjPlehNvDvxq1Eb6I0v0CA01OwtD2QH+jnKGK7/RXwOfKHZQDsfZ1qL725So8z2rLfTOiIBn01zwSZTPoMC0NoDEj1H7RUpuSTSWazRmZJAi4S9aWU7DK+aWp0vR4UzvxWNFuzhhSJPOrHBx0O6st67oVRyhhIFo67dIfgI/fDwuT7+hAfAzGtuWAW1SI33ucDtaSSs3CT6ndPIU1jzRwrK/Xoq2vzyso6ptj9N/qJfauVUtwhQs//9hGjIP7H2m4maUDR60qDveUy4QNbRoJQuT28FrZxdYjEWyU7E3/yuBSX5Lggk9GuolpGBTj3EDLth0LUsB/hjjGNSebNL/pF5wQR9Usu9omXf4f3dPfU/X0SaWjeY1ukU4saRefn9FIu1ZV3w6TQUybM/2ZcHzbS2JDieirMTZ2uGUVZyAX4TID40Pc84bcFbfQULkqBGPmp2X3rrfJgg8GmmX92qT/OEEPQ6tsA909dxvXGMYzb/7B5MjiAjdkhhIlRzjFz8zy0dkTAMopxwHPI4Fr1z/LhP8Or7pv31HfG/RIW8pOcanvvRRzqoSohDrfxobzczce42S/qrD0sE2gQdwbnAh0JlPmB7erSrqhxEjw0pHXd8CWx4yH3oJQ== gvdvries + pneerincx: + comment: 'Pieter Neerincx' + uid: 1012 + pub_keys: | + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCdOt9U8m3oa/ka8vRTOWxU9uh13hR9F5FoW7SRbrQMWX3XYCEF1mFSTU0WHqYlkOm5atbkqRnR2WUOuG2YjCDJ6KqvpYGjITqHilBCINkWuXozoT5HkGbMtcN1nYDh4b+lGhg3ttfTBKBPusLz0Mca68EL6MjmSsgbRSIceNqFrfbjcc/YhJo7Kn769RW6W/ToClVHNHqgC47ZGXDc5acUrcfiaPNFSlyUjqCMKyO7sGOm/o4TTLffznH4A4iNn+/IX+7dGZRlwcmPjsBlpMk8zjQQqDE6l/UykbwKgYBJRO02PeNg3bqDAwSGR5+e4raJ3/mN3tkQqC/cAD3h4eWaRTBJdnLltkOFFeXux4jvuMFCjLYslxHK/LH//GziarA0OQVqA+9LWkwtLx1rKtNW6OaZd45iandwUuDVzlbADxwXtqjjnoy1ZUsAR83YVyhN/fqgOe2i34Q48h27rdkwRwAINuqnoJLufaXyZdYi4QintKOScp3ps/lSXUJq+zn7yh54JCz2l/MhDNUBpBWvZevJTXxqQBszAp5gv0KE2VuPOyrmzo+QeBxKqglMSonguoVolfb9sEYT5Xhu1zR6thRtoBT813kzpeVSzMUAr/KOD+ILSjWKUNT0JuiCXsEDD7Zqx/kspTsHpi/+2irAdcXgAEA+fiJqxsNfV4cpQw== pneerincx + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBzwniHWpMcGx0Pj3rZvXuaJbZa+iNbNpIhuARXW/GV0 pneerincx ED25519 + mbijlsma: + comment: 'Marieke Bijlsma' + uid: 1013 + pub_keys: | + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDb8ulPLVGL78KJ8Egg7i2V9JLsge4m4+G6kdCuX7p7T7WRFH54DjaBl52UnkgbuTML/2r6c1gk3pXF2wlOtyHKqhD4AyvY1l/NyLSn1kkgY3XaWp64pFmmEydqOOrPX6L9cMGEyPjnfjr/GWbihzFn7E9Hc0kkp7CPbbdAlmwnKTk1m87CtKHVVV7rg7t7tI+pwoBhAGq1KpwxvNyKQT9Duwo+0eP/xZPZ/b12j7edxjjgpEtV+mCldsbXS+JyMVAScJXYV6TYcSyZhNhLnhzZIikjvV8/LcFxt4sURMeWLkiw3EqQOpDazJT6p6zo0KFfglvYG7ps8ijsnYuz4BkvMGx5bJQZVT4RdzQASisEUhJY1t0ZLGfs4bix2yMNmwCkypNZq72G2p/e2A9n1NhVSyOXfzHonQBFbL5xUX/1PNKXt027wTCbnl0OA/gLdez0NeanRzVjfDJGLOueC93rAJRIAWk+UOUBWAmHvL7XdnrgPq2puxk3sKCijUgxEkh1xqgMST5MTq3DMzese4jeuAQErhs5WnkOiythn4i4ydJ0oUwAjZhSFnGBSzol0Iar6chxfsp2U/pcl97QKXGLXkIvlZ7vMtYdbxopJ8uYQaOdkDycU1upR6pylZ6LnP8mF+iTqcHry4rmQ5rp46m2L5Cbp3eJZ7LFPXTVLUvWWw== mbijlsma + mswertz: + comment: 'Morris Swertz' + uid: 1014 + pub_keys: | + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDfKxBNTqlsoTt1DloXbsRDqUyZgYbAGFsSOKhkHfjTD7zotloUwsd7388J/Ip9dOE5xPySWMSqmjcY8FLYIsEnKaC2LKJya6ck0sOrW+kynV+H9VxLsdnErw5bh8Uga3cGeHX+NKRw9dyNkvFB5B690PidBmSXRRTvXVUBvUeYAAdaoVGSQFtgV/lri2ojWR0yVpy2oCqI/eoXO13NJZS8hyoMDTI1QmnuqarNPIIvYmrAr/bO0fNJuzLqzoAcfw6I4rOw/iE8Zuo2Tl9Erjh1J9nJ91Q+78/VY1H7etltNZe4zxtipaB0HfjkHmhTW2xNMNi5D9FkzHbPhlpShzwsajP0xRpQ8JIgsOli/OHnVU0Mzd6WQf43CliNQMj5Qh50TUYdd0IW0ypjz/h2QEmh560R0NHbvRJ6BDHACceszAMPQjj4zlJLxZJejQ2GijWtvL2Yq2XyVlE7rPH3GA1x3Fy29yBNrgkWsH5CKLMudqBiQ6Js9rHJwQx/WjMA6hLiNqxbHW8t5UHNA4C/tppT12qLWvQkAUUOh9ij/aRnT69V4DlZ/nfbtcJWSjiIToCX++GATm1JrlmzGYoqZy5OMGp5SIdd6+CT+D8E01q9nZYkWokT2EeL3r6I1b8CwIVpmDb5cx6d60tOLjh09jeQMc0PcxeRs6Jo6lQj3L4sZw== m.a.swertz@rug.nl + rkanninga: + comment: 'Roan Kanninga' + uid: 1015 + pub_keys: | + # Revoked: key format not compliant with requirements. + henkjan: + comment: 'Henk-Jan Zilverberg' + uid: 1016 + pub_keys: | + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKOKgVel0GbF67zZaVR0TFo82e5XeZOP1e3Ld3gIdaER h.j.zilverberg + solve-rd-dm: + comment: 'Datamanager user of solve-rd group' + uid: 1018 + pub_keys: + umcg-atd-dm: + comment: 'Datamanager user of umcg-atd group' + uid: 1019 + pub_keys: + envsync: + comment: 'Environment Synchronizer' + uid: 1017 + pub_keys: | + # No direct logins required: sudo only. +# +# Local group specs. +# Note: +# * all local groups are listed here. +# * In ../[name]-cluster/vars.yml we list which groups are created locally on which cluster. +# * Never ever change nor recycle a GID value here unless you are in for a surprise... +# +auth_groups: + admin: + gid: 20000 + docker: + gid: 20001 + users: + gid: 20002 + depad: + gid: 20003 + solve-rd: + gid: 20004 + umcg-atd: + gid: 20005 ... diff --git a/group_vars/cluster.yml b/group_vars/cluster.yml index 3c2df7ba2..5a2adf0b9 100644 --- a/group_vars/cluster.yml +++ b/group_vars/cluster.yml @@ -1,5 +1,11 @@ --- ansible_python_interpreter: /usr/bin/python2.7 +# +# Configure allowed network ports for geerlingguy.firewall role +# firewall_allowed_tcp_ports: - - "22" - - "6818" # slurmd + - '22' # SSH + - '6817' # Slurm + - '6818' # Slurm + - '6819' # Slurm +... diff --git a/group_vars/gearshift-cluster/secrets.yml b/group_vars/gearshift-cluster/secrets.yml index c3d2c0924..a534bb3bd 100644 --- a/group_vars/gearshift-cluster/secrets.yml +++ b/group_vars/gearshift-cluster/secrets.yml @@ -1,22 +1,23 @@ $ANSIBLE_VAULT;1.1;AES256 -66366630663835306636383866396162373361353765323165356330653435616438393535633833 -3938343064333736633335373133313234386362666162660a633835636637326566633038326132 -30633735373366663933383963666634376536666266356238613530386633353037336537326334 -3465626531626132360a316361653864633863323533363930633639383133303365373230623639 -31613739316365663061663530356533613739626233316631616339383530666465633036636634 -36646237343563633534663431623264646237306563373436663332396534306335653963373161 -30633038316538623437653661616534313131373833663765326138333364326539663535306137 -31373433373637356435343735333963383265306433633532363937353332636636393237383733 -65646166383432636433363530653866363537303334393937333032386431353134343630333363 -35393231393132333033363338396334663033373565653130386335316361333232623138343430 -35616163393831363265373239363963393462613834663363666164653735666431316439376239 -61656133326665326361346630306436626130303665613630613231363865336164643765333235 -30373930386361663965333864303032386337336264336332643739353662643833326464356637 -33633462393064316664356631386131613434326437353739643265373733336633646565303439 -63353364653334613835373664646437643961623130643935303539323438313034303832313539 -37386130376238656236663930383261313330303532383263653839626436363838363862653363 -34393339666535343632643435613633333465623030663031633932313365663138336331393564 -62303132333030643633313939633332393438343338613766366232326231663238616339373737 -34633866306562613233666138316133333933313838336464366635653838303366653238373238 -65313636383863383665613133623265303531626163623262386633346132383133336631303061 -61366363333363366165613766643239386434356362303238333865613331373130 +37323464326535306263623264326333313336386432393265323939636436653965643730616230 +6666326235643761356666396138393662363734336131610a666235666234326136396630663037 +30336633626235333836666566373162646635353733306466373663393735616235373066386365 +6263356661383164300a326561623066323561356162336466323636343230666165303239303530 +39303633306266616239643933306165326233653830323933306635396433376164386336393934 +63303435633535343437356266633463326461346232353463303534346537323831363936333734 +33623366346566643736663834633266656334363961613464333063353330613266383838356439 +31613939363137613230373561376166626435323465636531303365393961333435396334383539 +38343264656461326563303562643163343562633737326434356536356138363339363733376262 +31373539636139313865353437393431613737343832303534373162663231316633643936306233 +35373066373464653565643637326234363738386635653231346638343431613762663837626136 +30323437613462646563343134653563396537316564353566623331636364656236363463643562 +63646162626564373163356536336136356631353734376462613331353830653637633436386233 +36616230663062656332633033326162643638633335633364346433643636623339633239383966 +34383432393335613439303065353865303631646361376337646634343730373465323838303964 +62343633393465623030323838616262313731313235646331636561356135373637623031633231 +62646135373539613965306139393466333964626665386431373861646163306138663563623033 +63643032663762613532646630373234343533376635633930636236663138396564666439326530 +63643665323838353433366364646133333863613134383366653163326263316461626435373565 +64386562303366303132306239383365623134333632363038353436613362633161613964363835 +35343333343533656161393964363961663734333137353436623730383139653535313535633932 +3631343435383561356538373962383664333961373665323430 diff --git a/group_vars/gearshift-cluster/vars.yml b/group_vars/gearshift-cluster/vars.yml index f9cd8fb2f..3780e7ccd 100644 --- a/group_vars/gearshift-cluster/vars.yml +++ b/group_vars/gearshift-cluster/vars.yml @@ -2,6 +2,21 @@ slurm_cluster_name: 'gearshift' slurm_cluster_domain: 'hpc.rug.nl' stack_prefix: 'gs' +mailhub: '172.23.34.34' +rewrite_domain: "imperator.{{ slurm_cluster_domain }}" +motd: Vare, Vare, redde legiones! +additional_etc_hosts: | + 172.23.40.21 gs-compute01 gs-compute01.hpc.local + 172.23.40.22 gs-compute02 gs-compute02.hpc.local + 172.23.40.23 gs-compute03 gs-compute03.hpc.local + 172.23.40.24 gs-compute04 gs-compute04.hpc.local + 172.23.40.25 gs-compute05 gs-compute05.hpc.local + 172.23.40.26 gs-compute06 gs-compute06.hpc.local + 172.23.40.27 gs-compute07 gs-compute07.hpc.local + 172.23.40.28 gs-compute08 gs-compute08.hpc.local + 172.23.40.29 gs-compute09 gs-compute09.hpc.local + 172.23.40.30 gs-compute10 gs-compute10.hpc.local + 172.23.40.31 gs-compute11 gs-compute11.hpc.local vcompute_hostnames: "{{ stack_prefix }}-vcompute[01-11]" vcompute_sockets: 2 vcompute_cores_per_socket: 14 @@ -10,17 +25,62 @@ vcompute_max_cpus_per_node: "{{ vcompute_sockets * vcompute_cores_per_socket - 2 vcompute_max_mem_per_node: "{{ vcompute_real_memory - vcompute_sockets * vcompute_cores_per_socket * 512 }}" vcompute_local_disk: 2900 vcompute_features: 'tmp01' +vcompute_ethernet_interfaces: + - 'eth0' + - 'eth1' + - 'eth2' ui_hostnames: "{{ slurm_cluster_name }}" ui_sockets: 2 ui_cores_per_socket: 2 ui_real_memory: 8192 ui_local_disk: 0 ui_features: 'prm01,tmp01' +ui_ethernet_interfaces: + - 'eth0' + - 'eth1' + - 'eth2' ssh_host_signer_ca_private_key: "{{ ssh_host_signer_ca_keypair_dir }}/umcg-hpc-ca" uri_ldap: 172.23.40.249 uri_ldaps: comanage-in.id.rug.nl ldap_port: 389 ldaps_port: 636 -ldap_base: ou=umcg,o=asds +ldap_base: ou=research,o=asds ldap_binddn: cn=clusteradminumcg,o=asds +filter_passwd: '(|(rugpersonentitlementvalue=scz)(rugpersonentitlementvalue=umcg))' +filter_shadow: '(|(rugpersonentitlementvalue=scz)(rugpersonentitlementvalue=umcg))' +pam_authz_search: '(|(&(objectClass=posixGroup)(cn=co_bbmri_g-GRP_Gearshift)(memberUid=$username))(&(cn=$username)(rugpersonentitlementvalue=umcg)))' +nameservers: [ + '172.23.40.244', # Order is important: local DNS for Isilon storage first! + '8.8.4.4', # Google DNS. + '8.8.8.8', # Google DNS. +] +local_admin_groups: + - 'admin' + - 'docker' +local_admin_users: + - 'egon' + - 'henkjan' + - 'wim' +envsync_user: 'umcg-envsync' +envsync_group: 'umcg-depad' +pfs_mounts: [ + { pfs: 'umcgst10', + source: 'gcc-storage001.stor.hpc.local:/ifs/rekencluster/umcgst10', + type: 'nfs4', + rw_options: 'defaults,_netdev,vers=4.0,noatime,nodiratime', + ro_options: 'defaults,_netdev,vers=4.0,noatime,nodiratime,ro' }, +] +lfs_mounts: [ + { lfs: 'home', + pfs: 'umcgst10' }, + { lfs: 'groups/GROUP/tmp01', + pfs: 'umcgst10', + groups: ['umcg-atd', 'umcg-gcc'] }, + { lfs: 'groups/GROUP/prm01', + pfs: 'umcgst10', + groups: ['umcg-atd', 'umcg-gcc'] }, + { lfs: 'env01', + pfs: 'umcgst10', + machines: "{{ groups['compute-vm'] + groups['user-interface'] }}" }, +] ... diff --git a/group_vars/hyperchicken-cluster/secrets.yml b/group_vars/hyperchicken-cluster/secrets.yml index 6b72a27f5..1eed7a3fb 100644 --- a/group_vars/hyperchicken-cluster/secrets.yml +++ b/group_vars/hyperchicken-cluster/secrets.yml @@ -1,19 +1,22 @@ $ANSIBLE_VAULT;1.1;AES256 -65663166613837656436313139396532613838346234303835366338623938623737636435623030 -3438356330643166383735633363623965383233356336330a353233663163353661626564643338 -61653138373230343832383139386637643432376231343237613835363731373837353363636439 -6137646633303661370a653762326165343039346237353964383165323339653535333762643830 -61633863356234383233393630353065363130353333343532373238306538356435643264343938 -36396366303765373862343338363534343763336534626363633763386130613833353961346535 -34353539313066666463623961353134616333326538366235333831316565346266313933376466 -32313533623162353535633964346630336266636162323864656530343131343663303339646339 -36623866663661666533363861663033373439643634363136343032343436396637373965316666 -35343236616335313164396463363461636338633030363837616231303230393138303531343739 -61643238356537646634343563323066396636323339396538313338346666386130636537343435 -31626133306530306566323137323361653065356437613937643830386330636361653935613961 -33373461363361316534353266613165373066633963363837366332326234663830353835646337 -36646263323234303261663861623139316131663763616134326263656236356165383333663564 -32306562366235386431623232336165653135376364323365353636373932323330306136656563 -39383038393133616236366137663035303863333836626462363836343538363438653633666264 -66643130313061633930303437353166653130356235356439373766313336363539376233323733 -3932323864356263353166353465623931666438323631303065 +37643739623137373937626163616339396636303734303334373166643532326565333139643935 +6265376364346265343031643261363830393833636233370a653233383235343739326137333663 +64323762313064366230663431373365623830616263306131333966643533646533316462333462 +3331626536623633300a646431653132343337633936326138363763643838633461613230656336 +36306563656432376539353839323865656566346431336266386665663764343262653130643164 +62323064646437666537626239663439666334303537623335343036303161643031373963333061 +65633837616239303663303138646431643165616639366362303161363231396166326131303562 +63616533633566666239303965326335373561313937636536356139623961306230646231643864 +61363632313737326564663930343061656336356634336631623839336531333564376133613835 +30363137613735326265346361313861626631396439633533303866343533313237346566356362 +62353037373735653061313233643732653030396134323132323135376131336535383664666131 +65323437306264616232303436363133373035326462653539653963663937656463663136346335 +66656634353730336461656161336536306362323533373261643338623865613863373164633266 +39656663316664326435316232313635373734303137333131646138336165346266613161353737 +34306333386532633066363164326161343338303831626361333333326235303861333633316561 +31326334316630626635313135323561643035316233653962353464363966303832663536666339 +33393439643637363963653234333561656234366362323962363530613439663236333935643138 +63633235653161373463393462643632306134346636343766646134663931336433353336633761 +31306362636564646534393662663266353731313133393636393866643661613664366636373464 +61626465373864636537363839383962623034636233656139656562623565393032336463633435 +32396434333330396332373339323132656438636137303162616665653230393262 diff --git a/group_vars/hyperchicken-cluster/vars.yml b/group_vars/hyperchicken-cluster/vars.yml index b010e2cdf..4820a2c62 100644 --- a/group_vars/hyperchicken-cluster/vars.yml +++ b/group_vars/hyperchicken-cluster/vars.yml @@ -1,22 +1,31 @@ --- slurm_cluster_name: 'hyperchicken' -#slurm_cluster_domain: '' +slurm_cluster_domain: 'gcc.rug.nl' stack_prefix: 'hc' +mailhub: '192.168.0.5' +rewrite_domain: "{{ stack_prefix }}-sai.{{ slurm_cluster_domain }}" +motd: "To solve or not to solve, that's the question." vcompute_hostnames: "{{ stack_prefix }}-vcompute[01-05]" -vcompute_sockets: 1 -vcompute_cores_per_socket: 9 -vcompute_real_memory: 20000 +vcompute_sockets: 16 +vcompute_cores_per_socket: 1 +vcompute_real_memory: 64264 vcompute_max_cpus_per_node: "{{ vcompute_sockets * vcompute_cores_per_socket - 2 }}" vcompute_max_mem_per_node: "{{ vcompute_real_memory - vcompute_sockets * vcompute_cores_per_socket * 512 }}" vcompute_local_disk: 0 vcompute_features: 'tmp07' +vcompute_ethernet_interfaces: + - 'eth0' + - 'eth1' ui_hostnames: "{{ slurm_cluster_name }}" -ui_sockets: 1 +ui_sockets: 4 ui_cores_per_socket: 1 -ui_real_memory: 3000 +ui_real_memory: 7821 ui_local_disk: 0 ui_features: 'prm07,tmp07' -ssh_host_signer_ca_private_key: "{{ ssh_host_signer_ca_keypair_dir }}/umcg-hpc-ca" +ui_ethernet_interfaces: + - 'eth0' + - 'eth1' +ssh_host_signer_ca_private_key: "{{ ssh_host_signer_ca_keypair_dir }}/umcg-hpc-development-ca" key_name: Gerben image_cirros: cirros-0.3.4-x86_64-disk.img image_centos7: centos7 @@ -32,4 +41,62 @@ security_group_id: SSH-and-ping-2 slurm_ldap: false availability_zone: AZ_1 local_volume_size: 1 +nameservers: [ + '/em-isi-3126.ebi.ac.uk/10.35.126.201', # Local DNS lookups for shared storage. + '8.8.4.4', # Google DNS. + '8.8.8.8', # Google DNS. +] +local_admin_groups: + - 'admin' + - 'docker' +local_admin_users: + - 'egon' + - 'gerben' + - 'henkjan' + - 'marieke' + - 'morris' + - 'pieter' + - 'wim' + - 'umcg-atd-dm' + - 'solve-rd-dm' +envsync_user: 'envsync' +envsync_group: 'depad' +local_regular_groups: + - 'users' + - 'depad' + - 'solve-rd' + - 'umcg-atd' +local_regular_users: + - user: 'envsync' + groups: ['depad'] + - user: 'gvdvries' + groups: ['users', 'depad','umcg-atd', 'solve-rd'] + - user: 'mbijlsma' + groups: ['users', 'depad','umcg-atd', 'solve-rd'] + - user: 'mswertz' + groups: ['users', 'depad','umcg-atd', 'solve-rd'] + - user: 'pneerincx' + groups: ['users', 'depad','umcg-atd', 'solve-rd'] + - user: 'rkanninga' + groups: ['users', 'depad','umcg-atd', 'solve-rd'] +pfs_mounts: [ + { pfs: 'Solve-RD', + source: 'em-isi-3126.ebi.ac.uk:/ifs/Solve-RD', + type: 'nfs', + rw_options: 'defaults,_netdev,noatime,nodiratime', + ro_options: 'defaults,_netdev,noatime,nodiratime,ro' }, +] +lfs_mounts: [ + { lfs: 'home', + pfs: 'Solve-RD' }, + { lfs: 'groups/GROUP/tmp09', + pfs: 'Solve-RD', + groups: ['umcg-atd', 'solve-rd'] }, + { lfs: 'groups/GROUP/prm09', + pfs: 'Solve-RD', + groups: ['umcg-atd', 'solve-rd'] }, + { lfs: 'env09', + pfs: 'Solve-RD', + machines: "{{ groups['compute-vm'] + groups['user-interface'] }}" }, +] ... diff --git a/group_vars/talos-cluster/secrets.yml b/group_vars/talos-cluster/secrets.yml index 91c1b90df..a169755c7 100644 --- a/group_vars/talos-cluster/secrets.yml +++ b/group_vars/talos-cluster/secrets.yml @@ -1,27 +1,26 @@ $ANSIBLE_VAULT;1.1;AES256 -36363232356235643436383162303734376463343966373436646339303861326236666337633138 -6561663835303037373831383233333134366461653539360a643237333166393266656338613530 -66366266643264383761313831343934636261666366396539376130666465313662313537366332 -3235616432613462370a623130393439636466663734326136646139373962393331316663326662 -30643837373934343337646430373463623865383931383764366466376261663034306234356133 -64386666643562653664653933336236363462346134336534616166363561306235356463653963 -65656463663232626137613533316139623462653434666532343263316362656361623032333230 -33343630376437613033333263343439636666636365336263393938383264346138333364393832 -31613663303362353364663038366637303932353364333661303635623030323666346433393265 -36303739313338353932326139373038316130323639323938613764623833353631623539316663 -33653636653865323733383133653338303861313434383136653830393637636264363234303161 -38666363636563613464313362333839643631363333636137343231306433373235336165346438 -39643634383863333631313764303161333764623930343731353037326530633937646263326234 -38656236366665663737333235336632303835333530303236363336333766626666386330303138 -34636433316163376335656431613631646436386530363837366133383764326465303865343961 -63663833303732373762303034636465383639623232663664386334323931313034353631666366 -30336266616137373862316531646464336132363436396430373233316330343336346635646537 -36613439623561393365383539366435393235356434643937323733313462386430303832653635 -35663966356561383161386464396635353935623738333965336637613931383235336138393931 -32663066613062326231393865363137613932356237343762626536316266663332333566383737 -66663933313361653639336664653934303761363966373536623231366364666362393535663933 -30383166643366613230333739333165336364383637303236316137333865313762643361383363 -65666263343463353966353461616231623164393738373034396662616563306536616538346335 -35356238323965346639313063306365313031366563653866616534636538373534653233663535 -38633963323534616336353164333435616635373165623761363864666337353764636333303132 -3132333039393739303933646165343862306632613032336538 +66613933323735386131363439346137336232393232663961303536663131313835663266636638 +3137623638393635643937316366643733636665316666620a653435613333313336356137353164 +64636637613330633436666566316439343764373337333464366136333662313231616239353131 +3832383636396163380a643063653564656661376131376264303339376433613461323833633336 +39633832633631316165306432373766336638366261313238346163323963613264656336363031 +66363563333365363761333037383836633966303763356634613865326465383333323562303437 +61643837663034633439633334333833656136386332643166613563646230383635333639303464 +32343565323639373135393235363334383364313365343464323336646166303334333033303433 +62656238316233336462366334316561313634653639653865653834373764373762323432633562 +34616235363231383734663234616233346433373030386631613832313830343534346664303430 +34376332623236383934633131316636613233653766326538336631383962346165323736633363 +64386235663930313231313534343530366135656362383437656230646530653331353835653362 +61343839376631656165326338323364653734623961383534396432333761356665353636626433 +30383130313566646465663933353033343365396361326339346539323562633032316536323637 +32646330643632636366383931383234623061636430336135376130376462663137376263393438 +34363363343832623562303637376431323733326633336335313863643834393835623335656565 +66623363353738643966306164316164393235383631316161633635653662306664666263666633 +34623465376131323039383632643266346430636630363463623866363635353638363864666539 +30306135363038363730313938363366646135656636663132313835613435623639346434396534 +31386163646532373062633631373331656366613338623638313633636165323961346562323336 +39633866336266343634393964663635386635323663333665343663326662343233343931393964 +65646534393832353438383134666132613930326561336266353165636335396332333037653863 +31636237643837623066383033646362363638613333396663343630343834373436313332373233 +32643532616630633765633530313561313636366632373364393533356162633134326531646161 +3234 diff --git a/group_vars/talos-cluster/vars.yml b/group_vars/talos-cluster/vars.yml index 74d738673..4774a8c2a 100644 --- a/group_vars/talos-cluster/vars.yml +++ b/group_vars/talos-cluster/vars.yml @@ -2,20 +2,29 @@ slurm_cluster_name: 'talos' slurm_cluster_domain: 'hpc.rug.nl' stack_prefix: 'tl' +mailhub: '172.23.34.34' +rewrite_domain: "{{ stack_prefix }}-sai.{{ slurm_cluster_domain }}" +motd: "It's highly addictive" vcompute_hostnames: "{{ stack_prefix }}-vcompute[01-03]" -vcompute_sockets: 2 -vcompute_cores_per_socket: 2 -vcompute_real_memory: 8192 +vcompute_sockets: 4 +vcompute_cores_per_socket: 1 +vcompute_real_memory: 7822 vcompute_max_cpus_per_node: "{{ vcompute_sockets * vcompute_cores_per_socket - 2 }}" vcompute_max_mem_per_node: "{{ vcompute_real_memory - vcompute_sockets * vcompute_cores_per_socket * 512 }}" vcompute_local_disk: 0 vcompute_features: 'tmp08' +vcompute_ethernet_interfaces: + - 'eth0' + - 'eth1' ui_hostnames: "{{ slurm_cluster_name }}" -ui_sockets: 2 -ui_cores_per_socket: 2 -ui_real_memory: 8192 +ui_sockets: 4 +ui_cores_per_socket: 1 +ui_real_memory: 7822 ui_local_disk: 0 ui_features: 'prm08,tmp08' +ui_ethernet_interfaces: + - 'eth0' + - 'eth1' ssh_host_signer_ca_private_key: "{{ ssh_host_signer_ca_keypair_dir }}/umcg-hpc-development-ca" uri_ldap: 172.23.40.249 uri_ldaps: comanage-in.id.rug.nl @@ -23,4 +32,42 @@ ldap_port: 389 ldaps_port: 636 ldap_base: ou=umcg,o=asds ldap_binddn: cn=clusteradminumcg,o=asds +nameservers: [ + '/gcc-storage001.stor.hpc.local/172.23.40.244', # Local DNS lookups for shared storage. + '8.8.4.4', # Google DNS. + '8.8.8.8', # Google DNS. +] +local_admin_groups: + - 'admin' + - 'docker' +local_admin_users: + - 'egon' + - 'gerben' + - 'henkjan' + - 'marieke' + - 'morris' + - 'pieter' + - 'wim' +envsync_user: 'umcg-envsync' +envsync_group: 'umcg-depad' +pfs_mounts: [ + { pfs: 'umcgst11', + source: 'gcc-storage001.stor.hpc.local:/ifs/rekencluster/umcgst11', + type: 'nfs4', + rw_options: 'defaults,_netdev,vers=4.0,noatime,nodiratime', + ro_options: 'defaults,_netdev,vers=4.0,noatime,nodiratime,ro' }, +] +lfs_mounts: [ + { lfs: 'home', + pfs: 'umcgst11' }, + { lfs: 'groups/GROUP/tmp08', + pfs: 'umcgst11', + groups: ['umcg-atd', 'umcg-gcc'] }, + { lfs: 'groups/GROUP/prm08', + pfs: 'umcgst11', + groups: ['umcg-atd', 'umcg-gcc'] }, + { lfs: 'env08', + pfs: 'umcgst11', + machines: "{{ groups['compute-vm'] + groups['user-interface'] }}" }, +] ... \ No newline at end of file diff --git a/hc-cluster.yml b/hc-cluster.yml index d3cf02f53..307785433 100644 --- a/hc-cluster.yml +++ b/hc-cluster.yml @@ -1,4 +1,33 @@ --- +- name: Sanity checks before we start. + hosts: all + pre_tasks: + - name: Verify Ansible version meets requirements. + assert: + that: "ansible_version.full | version_compare('2.4', '>=')" + msg: 'You must update Ansible to at least 2.4.x to use this playbook.' + +- import_playbook: local_admin_users.yml + +- name: Install roles needed for all virtual cluster components. + hosts: all + roles: + - logins + - ssh_host_signer + - ssh_known_hosts + tasks: + - cron: + # + # Silly workaround for bug in interaction dbus <-> logind + # Need DBus 1.11.10 for a fix, but CentOS 7.6 is stuck on dbus 1.10.24. + # + name: Restart systemd-logind + minute: "/10" + user: root + job: /bin/systemctl restart systemd-logind + cron_file: restart_logind + become: true + - name: Install roles needed for all virtual cluster components except jumphosts. hosts: cluster become: true @@ -8,15 +37,28 @@ # - ldap - node_exporter - cluster + - resolver + - shared_storage + +- name: Install ansible on admin interfaces (DAI & SAI). + hosts: + - sys-admin-interface + - deploy-admin-interface + become: True + tasks: + - name: install Ansible + yum: + name: ansible-2.6.6-1.el7.umcg - name: Install roles needed for jumphosts. hosts: jumphost become: true roles: - - docker + - geerlingguy.repo-epel +# - ldap - cluster - node_exporter -# - geerlingguy.security + - geerlingguy.security tasks: - cron: name: Reboot to load new kernel. @@ -40,8 +82,6 @@ tasks: roles: - compute-vm - # - isilon - # - datahandling - slurm-client - name: Install User Interface (UI) @@ -50,20 +90,7 @@ tasks: roles: - slurm_exporter - - user-interface - # - datahandling - # - isilon - slurm-client -#- name: Install ansible on admin interfaces (DAI & SAI). -# hosts: -# - imperator -# - sugarsnax -# become: True -# tasks: -# - name: install Ansible -# yum: -# name: ansible-2.6.6-1.el7.umcg - -- import_playbook: hc-users.yml - #- import_playbook: ssh-host-signer.yml +- import_playbook: local_regular_users.yml +... diff --git a/hc-users.yml b/hc-users.yml deleted file mode 100644 index 58739bf6e..000000000 --- a/hc-users.yml +++ /dev/null @@ -1,82 +0,0 @@ -# SSH keys of HPC colleagues. -# for more advanced examples, see: -# http://docs.ansible.com/ansible/latest/authorized_key_module.html ---- -- name: Initial setup - hosts: all - become: True - - tasks: - - group: - name: admin - state: present - - - name: Passwordless sudo for admins - lineinfile: dest=/etc/sudoers line="%admin ALL=(ALL:ALL) NOPASSWD:ALL" - - - user: - name: pieter - comment: "Pieter Neerincx" - group: admin - - - authorized_key: - user: pieter - key: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCdOt9U8m3oa/ka8vRTOWxU9uh13hR9F5FoW7SRbrQMWX3XYCEF1mFSTU0WHqYlkOm5atbkqRnR2WUOuG2YjCDJ6KqvpYGjITqHilBCINkWuXozoT5HkGbMtcN1nYDh4b+lGhg3ttfTBKBPusLz0Mca68EL6MjmSsgbRSIceNqFrfbjcc/YhJo7Kn769RW6W/ToClVHNHqgC47ZGXDc5acUrcfiaPNFSlyUjqCMKyO7sGOm/o4TTLffznH4A4iNn+/IX+7dGZRlwcmPjsBlpMk8zjQQqDE6l/UykbwKgYBJRO02PeNg3bqDAwSGR5+e4raJ3/mN3tkQqC/cAD3h4eWaRTBJdnLltkOFFeXux4jvuMFCjLYslxHK/LH//GziarA0OQVqA+9LWkwtLx1rKtNW6OaZd45iandwUuDVzlbADxwXtqjjnoy1ZUsAR83YVyhN/fqgOe2i34Q48h27rdkwRwAINuqnoJLufaXyZdYi4QintKOScp3ps/lSXUJq+zn7yh54JCz2l/MhDNUBpBWvZevJTXxqQBszAp5gv0KE2VuPOyrmzo+QeBxKqglMSonguoVolfb9sEYT5Xhu1zR6thRtoBT813kzpeVSzMUAr/KOD+ILSjWKUNT0JuiCXsEDD7Zqx/kspTsHpi/+2irAdcXgAEA+fiJqxsNfV4cpQw== pneerincx' - state: present - -- hosts: - - cluster - become: True - tasks: - - user: - name: pieter - comment: "Pieter Neerincx" - group: admin - - - authorized_key: - user: pieter - key: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCdOt9U8m3oa/ka8vRTOWxU9uh13hR9F5FoW7SRbrQMWX3XYCEF1mFSTU0WHqYlkOm5atbkqRnR2WUOuG2YjCDJ6KqvpYGjITqHilBCINkWuXozoT5HkGbMtcN1nYDh4b+lGhg3ttfTBKBPusLz0Mca68EL6MjmSsgbRSIceNqFrfbjcc/YhJo7Kn769RW6W/ToClVHNHqgC47ZGXDc5acUrcfiaPNFSlyUjqCMKyO7sGOm/o4TTLffznH4A4iNn+/IX+7dGZRlwcmPjsBlpMk8zjQQqDE6l/UykbwKgYBJRO02PeNg3bqDAwSGR5+e4raJ3/mN3tkQqC/cAD3h4eWaRTBJdnLltkOFFeXux4jvuMFCjLYslxHK/LH//GziarA0OQVqA+9LWkwtLx1rKtNW6OaZd45iandwUuDVzlbADxwXtqjjnoy1ZUsAR83YVyhN/fqgOe2i34Q48h27rdkwRwAINuqnoJLufaXyZdYi4QintKOScp3ps/lSXUJq+zn7yh54JCz2l/MhDNUBpBWvZevJTXxqQBszAp5gv0KE2VuPOyrmzo+QeBxKqglMSonguoVolfb9sEYT5Xhu1zR6thRtoBT813kzpeVSzMUAr/KOD+ILSjWKUNT0JuiCXsEDD7Zqx/kspTsHpi/+2irAdcXgAEA+fiJqxsNfV4cpQw== pneerincx' - state: present - - - user: - name: gerben - comment: "Gerben van der Vries" - group: admin - - - authorized_key: - user: gerben - key: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCUfwAhBD4vCDYgsr04Kxn1e+vIcx7EzOEJrwi4Bv1Fc329TAifMTLeXXjPlehNvDvxq1Eb6I0v0CA01OwtD2QH+jnKGK7/RXwOfKHZQDsfZ1qL725So8z2rLfTOiIBn01zwSZTPoMC0NoDEj1H7RUpuSTSWazRmZJAi4S9aWU7DK+aWp0vR4UzvxWNFuzhhSJPOrHBx0O6st67oVRyhhIFo67dIfgI/fDwuT7+hAfAzGtuWAW1SI33ucDtaSSs3CT6ndPIU1jzRwrK/Xoq2vzyso6ptj9N/qJfauVUtwhQs//9hGjIP7H2m4maUDR60qDveUy4QNbRoJQuT28FrZxdYjEWyU7E3/yuBSX5Lggk9GuolpGBTj3EDLth0LUsB/hjjGNSebNL/pF5wQR9Usu9omXf4f3dPfU/X0SaWjeY1ukU4saRefn9FIu1ZV3w6TQUybM/2ZcHzbS2JDieirMTZ2uGUVZyAX4TID40Pc84bcFbfQULkqBGPmp2X3rrfJgg8GmmX92qT/OEEPQ6tsA909dxvXGMYzb/7B5MjiAjdkhhIlRzjFz8zy0dkTAMopxwHPI4Fr1z/LhP8Or7pv31HfG/RIW8pOcanvvRRzqoSohDrfxobzczce42S/qrD0sE2gQdwbnAh0JlPmB7erSrqhxEjw0pHXd8CWx4yH3oJQ== gvdvries@local.macbook' - state: present - - - user: - name: marieke - comment: "Marieke Bijlsma" - group: admin - - - authorized_key: - user: marieke - key: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDb8ulPLVGL78KJ8Egg7i2V9JLsge4m4+G6kdCuX7p7T7WRFH54DjaBl52UnkgbuTML/2r6c1gk3pXF2wlOtyHKqhD4AyvY1l/NyLSn1kkgY3XaWp64pFmmEydqOOrPX6L9cMGEyPjnfjr/GWbihzFn7E9Hc0kkp7CPbbdAlmwnKTk1m87CtKHVVV7rg7t7tI+pwoBhAGq1KpwxvNyKQT9Duwo+0eP/xZPZ/b12j7edxjjgpEtV+mCldsbXS+JyMVAScJXYV6TYcSyZhNhLnhzZIikjvV8/LcFxt4sURMeWLkiw3EqQOpDazJT6p6zo0KFfglvYG7ps8ijsnYuz4BkvMGx5bJQZVT4RdzQASisEUhJY1t0ZLGfs4bix2yMNmwCkypNZq72G2p/e2A9n1NhVSyOXfzHonQBFbL5xUX/1PNKXt027wTCbnl0OA/gLdez0NeanRzVjfDJGLOueC93rAJRIAWk+UOUBWAmHvL7XdnrgPq2puxk3sKCijUgxEkh1xqgMST5MTq3DMzese4jeuAQErhs5WnkOiythn4i4ydJ0oUwAjZhSFnGBSzol0Iar6chxfsp2U/pcl97QKXGLXkIvlZ7vMtYdbxopJ8uYQaOdkDycU1upR6pylZ6LnP8mF+iTqcHry4rmQ5rp46m2L5Cbp3eJZ7LFPXTVLUvWWw== mbijlsma' - state: present - - - user: - name: morris - comment: "Morris swertz" - group: admin - - - authorized_key: - user: morris - key: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDfKxBNTqlsoTt1DloXbsRDqUyZgYbAGFsSOKhkHfjTD7zotloUwsd7388J/Ip9dOE5xPySWMSqmjcY8FLYIsEnKaC2LKJya6ck0sOrW+kynV+H9VxLsdnErw5bh8Uga3cGeHX+NKRw9dyNkvFB5B690PidBmSXRRTvXVUBvUeYAAdaoVGSQFtgV/lri2ojWR0yVpy2oCqI/eoXO13NJZS8hyoMDTI1QmnuqarNPIIvYmrAr/bO0fNJuzLqzoAcfw6I4rOw/iE8Zuo2Tl9Erjh1J9nJ91Q+78/VY1H7etltNZe4zxtipaB0HfjkHmhTW2xNMNi5D9FkzHbPhlpShzwsajP0xRpQ8JIgsOli/OHnVU0Mzd6WQf43CliNQMj5Qh50TUYdd0IW0ypjz/h2QEmh560R0NHbvRJ6BDHACceszAMPQjj4zlJLxZJejQ2GijWtvL2Yq2XyVlE7rPH3GA1x3Fy29yBNrgkWsH5CKLMudqBiQ6Js9rHJwQx/WjMA6hLiNqxbHW8t5UHNA4C/tppT12qLWvQkAUUOh9ij/aRnT69V4DlZ/nfbtcJWSjiIToCX++GATm1JrlmzGYoqZy5OMGp5SIdd6+CT+D8E01q9nZYkWokT2EeL3r6I1b8CwIVpmDb5cx6d60tOLjh09jeQMc0PcxeRs6Jo6lQj3L4sZw== m.a.swertz@rug.nl' - state: present - - - user: - name: egon - comment: "Egon Rijpkema" - group: admin - - - authorized_key: - user: egon - key: '{{ item }}' - state: present - with_items: - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKUBdTEHUj6MxvfEU7KcI+UPAvqJ9jGJ7hHm3e7XFTb9 egon@egon-pc' - - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDStPUPXkcu81onUm/le54JCu174yXJJDsthDr96Mv8irBVBWuy5FxnaASuDpmC4QE4s0UAIg1iq/SWrr8qdBQ4OVuYFiW0S7ZJvcoKr/40Wh+T5MeltGQfmkDp6kBsfaMSo6M4tF1c8i+XgOgxb4fxHYb8mFhseztRLx6McxJJJLB0nu+T12WQ01nl0XtwD+3EsZWfxRH0KA59VHZSe3Anc5z+Fm7WU+1Vzy6/pkiIhVReI1L6VVhZsIdSu3fQK6fHQcujtfuw6RKEpisZQqnxMUviWQ98yeQXHk6Nx840WCh3vvKveEAoC4Y/UEZa1TMe6PczfUaLjaidUkpulJsP egon@egon-pc' diff --git a/heat.yml b/heat.yml deleted file mode 100644 index a5e7eecd5..000000000 --- a/heat.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -- hosts: all - name: Dummy to gather facts - tasks: [] - -- hosts: heat - become: True - roles: - - hpc-cloud/roles/heat diff --git a/heat/heat_cluster.yml b/heat/heat_cluster.yml index c08325158..043553a01 100644 --- a/heat/heat_cluster.yml +++ b/heat/heat_cluster.yml @@ -19,6 +19,10 @@ resources: networks: - network: vlan983 fixed_ip: 172.23.40.33 + - network: vlan985 + fixed_ip: 172.23.34.33 + - network: vlan985 + fixed_ip: 172.23.57.33 airlock: type: OS::Nova::Server diff --git a/heat/talos.yml b/heat/talos.yml index f36e754ae..e02e5a2ac 100644 --- a/heat/talos.yml +++ b/heat/talos.yml @@ -19,6 +19,8 @@ resources: networks: - network: vlan983 fixed_ip: 172.23.40.92 + - network: vlan985 + fixed_ip: 172.23.34.92 reception: type: OS::Nova::Server diff --git a/horizon.yml b/horizon.yml deleted file mode 100644 index 2ea928605..000000000 --- a/horizon.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -- hosts: all - name: Dummy to gather facts - tasks: [] - -- hosts: horizon - become: True - roles: - - hpc-cloud/roles/horizon diff --git a/host_vars/hc-sai b/host_vars/hc-sai deleted file mode 100644 index b13ae5593..000000000 --- a/host_vars/hc-sai +++ /dev/null @@ -1,3 +0,0 @@ ---- -mailhub: 192.168.0.5 -rewrite_domain: hc-sai.gcc.rug.nl diff --git a/host_vars/imperator b/host_vars/imperator deleted file mode 100644 index 48ae6bd00..000000000 --- a/host_vars/imperator +++ /dev/null @@ -1,4 +0,0 @@ ---- -mailhub: 172.23.34.34 -rewrite_domain: imperator.hpc.rug.nl -motd: Vare, Vare, redde legiones! diff --git a/host_vars/tl-sai b/host_vars/tl-sai deleted file mode 100644 index 392efae47..000000000 --- a/host_vars/tl-sai +++ /dev/null @@ -1,5 +0,0 @@ ---- -mailhub: 172.23.34.34 -rewrite_domain: tl-sai.hpc.rug.nl -motd: It's highly addictive -... \ No newline at end of file diff --git a/inventory.py b/inventory.py index b258678e5..fd2bdf655 100755 --- a/inventory.py +++ b/inventory.py @@ -5,13 +5,15 @@ External inventory script for Ansible ============================================================= -Generates Ansible inventory with hostnames from a static inventory file located in the same dir as this script. -By default this script looks for an inventory named +Generates Ansible inventory with hostnames from a static inventory file located +in the same dir as this script. By default this script looks for an inventory named inventory.ini - (default) or alternatively from a file defined in +or alternatively for an inventory file name as defined in export AI_INVENTORY='some_inventory.ini' -Optionally the hostnames can be prefixed with one of our proxy/jumphost servers. -Note we only use hostnames and not FQDN nor IP addresses as those are managed + +The hostnames parsed from the static inventory file can be prefixed +with the hostname of one of our proxy/jumphost servers. +Note we only use hostnames and not FQDN nor IP addresses as those are managed together with usernames and other connection settings in our ~/.ssh/config files like this: @@ -30,25 +32,52 @@ ProxyCommand ssh -X -q prefix-youraccount@$(echo %h | sed 's/+[^+]*$//').hpc.rug.nl -W $(echo %h | sed 's/^[^+]*+//'):%p ######################################################################################################## - When the environment variable AI_PROXY is set like this: export AI_PROXY='lobby' -then the hostname 'calculon' from inventory.ini will be prefixed with 'lobby' and a '+' -resulting in: +then the hostname 'calculon' from inventory.ini will be prefixed +with 'lobby' and a '+' resulting in: lobby+calculon which will match the 'Host lobby+*' rule from the ~/.ssh/config file. ============================================================= ''' -import os import argparse -import ConfigParser -import re -import sys +try: + # For Python >= 3.x + import configparser +except: + # For Python 2.x + import ConfigParser as configparser try: import json except ImportError: import simplejson as json - +import os +import re +import sys +from test.test_sax import start + +""" +Modified ConfigParser that allows ':' in keys and only uses '=' as separator. +We need the : to be able to specify groups of Ansible hosts like this: compute_nodes[01:16] +""" +class MyConfigParser(configparser.SafeConfigParser): + OPTCRE = re.compile( + r'(?P