NOTIC: Add rights to manage daemonsets

config/rbac/role.yaml

@@ -39,6 +39,7 @@ rules:
 - apiGroups:
   - apps
   resources:
+  - daemonsets
   - deployments
   - statefulsets
   verbs:

helm/soperator/templates/manager-rbac.yaml

@@ -40,6 +40,7 @@ rules:
 - apiGroups:
   - apps
   resources:
+  - daemonsets
   - deployments
   - statefulsets
   verbs:

images/common/scripts/complement_jail.sh

@@ -85,6 +85,15 @@ pushd "${jaildir}"
         mount --bind /usr/share/enroot/enroot-data usr/share/enroot/enroot-data
     fi
 
+    if ! getcap usr/bin/enroot-mksquashovlfs | grep -q 'cap_sys_admin+pe'; then
+        echo "Set capabilities for enroot-mksquashovlfs to run containers without privileges"
+        setcap cap_sys_admin+pe usr/bin/enroot-mksquashovlfs
+    fi
+    if ! getcap usr/bin/enroot-aufs2ovlfs | grep -q 'cap_sys_admin,cap_mknod+pe'; then
+        echo "Set capabilities for enroot-aufs2ovlfs to run containers without privileges"
+        setcap cap_sys_admin,cap_mknod+pe usr/bin/enroot-aufs2ovlfs
+    fi
+
     echo "Bind-mount slurm configs"
     for file in /mnt/slurm-configs/*; do
         filename=$(basename "$file")

images/jail/scripts/createuser.sh

@@ -3,8 +3,7 @@
 set -e
 
 if [[ $# -eq 0 ]] || [[ "$*" == *"-h"* ]] || [[ "$*" == *"--help"* ]]; then
-    echo "Usage: createuser <username> [--with-password] [--without-sudo] [--without-docker]"
-    echo "       [--without-ssh-key] [<args for adduser...>]"
+    echo "Usage: createuser <username> [--with-password] [--without-sudo] [--without-docker] [<args for adduser...>]"
     exit 0
 fi
 
@@ -46,18 +45,29 @@ if [[ "$*" != *"--without-docker"* ]]; then
     add_to_group docker
 fi
 
-if [ -n "$ssh_public_key" ]; then
-    home_dir=$(eval echo "~$username")
-    ssh_dir="$home_dir/.ssh"
-    if [ ! -d "$ssh_dir" ]; then
-        mkdir -p "$ssh_dir"
-        chown "$username:$username" "$ssh_dir"
-        chmod 700 "$ssh_dir"
-    fi
+home_dir=$(eval echo "~$username")
+ssh_dir="$home_dir/.ssh"
+authorized_keys="$ssh_dir/authorized_keys"
+internal_key="$ssh_dir/id_ecdsa"
 
-    authorized_keys="$ssh_dir/authorized_keys"
-    echo "Saving SSH key to '${authorized_keys}'"
-    echo "$ssh_public_key" >> "$authorized_keys"
+if [ ! -d "$ssh_dir" ]; then
+    mkdir -p "$ssh_dir"
+    chown "$username:$username" "$ssh_dir"
+    chmod 700 "$ssh_dir"
+fi
+
+if [ ! -f "$authorized_keys" ]; then
+    touch "$authorized_keys"
     chown "$username:$username" "$authorized_keys"
     chmod 600 "$authorized_keys"
 fi
+
+if [ -n "$ssh_public_key" ]; then
+    echo "Saving SSH key to '${authorized_keys}' ..."
+    echo "$ssh_public_key" >> "$authorized_keys"
+fi
+
+echo "Generating an internal SSH key pair ..."
+ssh-keygen -t ecdsa -f "$internal_key" -N ''
+chown "$username:$username" "$internal_key" "$internal_key.pub"
+cat "$internal_key.pub" >> "$authorized_keys"

images/populate_jail/populate_jail_entrypoint.sh

@@ -14,7 +14,7 @@ echo "Delete everything from jail directory"
 rm -rf /mnt/jail/*
 
 echo "Rclone and rsync jail rootfs into jail directory"
-rclone copy /jail /mnt/jail --progress --multi-thread-streams="$(nproc)" --links
+rclone copy /jail /mnt/jail --progress --transfers="$(nproc)" --links
 rsync --verbose --archive --one-file-system --xattrs --numeric-ids --sparse --acls --hard-links /jail/ /mnt/jail/
 
 echo "Set permissions for jail directory"

images/worker/docker/daemon.json

@@ -1,6 +1,6 @@
 {
   "hosts": [
-    "unix:///var/run/docker.sock",
+    "unix:///var/run/docker.sock"
   ],
   "runtimes": {
     "nvidia": {

internal/controller/clustercontroller/reconcile.go

@@ -67,6 +67,7 @@ import (
 //+kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch;update;patch;delete;create
 //+kubebuilder:rbac:groups=k8s.mariadb.com,resources=mariadbs,verbs=get;list;watch;update;patch;delete;create
 //+kubebuilder:rbac:groups=k8s.mariadb.com,resources=grants,verbs=get;list;watch;update;patch;delete;create
+//+kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=get;list;watch;update;patch;delete;create
 
 // SlurmClusterReconciler reconciles a SlurmCluster object
 type SlurmClusterReconciler struct {

internal/render/common/configmap.go

@@ -266,7 +266,6 @@ func RenderConfigMapSecurityLimits(componentType consts.ComponentType, cluster *
 
 func generateUnlimitedSecurityLimitsConfig() renderutils.ConfigFile {
 	res := &renderutils.MultilineStringConfig{}
-	res.AddLine("#Empty security limits file")
 	res.AddLine("# Set core file size to unlimited (-c)")
 	res.AddLine("*    soft    core        unlimited")
 	res.AddLine("*    hard    core        unlimited")