diff --git a/.github/workflows/build-slurm-images.yaml b/.github/workflows/build-slurm-images.yaml new file mode 100644 index 0000000..a535650 --- /dev/null +++ b/.github/workflows/build-slurm-images.yaml @@ -0,0 +1,143 @@ +# SPDX-FileCopyrightText: Copyright (C) Vantage Compute, Inc. +# SPDX-License-Identifier: Apache-2.0 + +name: Build SLURM Images with s2n TLS + +on: + push: + branches: + - main + - 'feat/**' + tags: + - 'v*' + pull_request: + branches: + - main + workflow_dispatch: + inputs: + slurm_version: + description: 'SLURM version (e.g., 25.11.2, 25.11.1)' + required: false + default: '25.11.2' + push_images: + description: 'Push images to registry' + required: false + default: 'false' + type: boolean + +env: + REGISTRY: ghcr.io/vantagecompute + # Default to latest 25.11.x release + SLURM_VERSION: ${{ github.event.inputs.slurm_version || '25.11.2' }} + +jobs: + build-ubuntu2404: + name: Build Ubuntu 24.04 Images + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + + strategy: + matrix: + target: + - slurmctld + - slurmdbd + - slurmrestd + - slurmd + - sackd + - login + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Log in to GitHub Container Registry + if: github.event_name != 'pull_request' + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract version info + id: version + run: | + # Extract version from tag or use default + if [[ "${{ github.ref }}" == refs/tags/v* ]]; then + VERSION="${{ github.ref_name }}" + VERSION="${VERSION#v}" # Remove 'v' prefix + else + VERSION="${{ env.SLURM_VERSION }}" + fi + echo "version=${VERSION}" >> $GITHUB_OUTPUT + + # Generate image tags + TAGS="${{ env.REGISTRY }}/${{ matrix.target }}:${VERSION}-ubuntu24.04" + if [[ "${{ github.ref }}" == refs/tags/v* ]]; then + TAGS="${TAGS},${{ env.REGISTRY }}/${{ matrix.target }}:latest-ubuntu24.04" + fi + echo "tags=${TAGS}" >> $GITHUB_OUTPUT + + - name: Build and push ${{ matrix.target }} + uses: docker/build-push-action@v6 + with: + context: schedmd/slurm/25.11/ubuntu24.04 + file: schedmd/slurm/25.11/ubuntu24.04/Dockerfile + target: ${{ matrix.target }} + push: ${{ github.event_name != 'pull_request' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/feat/') || startsWith(github.ref, 'refs/tags/v') || github.event.inputs.push_images == 'true') }} + tags: ${{ steps.version.outputs.tags }} + build-args: | + SLURM_VERSION=${{ steps.version.outputs.version }} + cache-from: type=gha + cache-to: type=gha,mode=max + labels: | + org.opencontainers.image.title=Vantage SLURM ${{ matrix.target }} + org.opencontainers.image.description=SLURM ${{ matrix.target }} with s2n TLS support + org.opencontainers.image.version=${{ steps.version.outputs.version }} + org.opencontainers.image.source=https://github.com/vantagecompute/slurm-containers + org.opencontainers.image.vendor=Vantage Compute, Inc. + + # Check for new upstream releases (runs weekly) + check-upstream: + name: Check Upstream Releases + runs-on: ubuntu-latest + if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Check for new SLURM releases + id: check + run: | + # Get latest release from SchedMD/slurm + LATEST=$(curl -s https://api.github.com/repos/SchedMD/slurm/releases/latest | jq -r .tag_name) + echo "Latest upstream SLURM release: ${LATEST}" + echo "latest=${LATEST}" >> $GITHUB_OUTPUT + + # Check if we have this version tagged + if git tag -l | grep -q "^v${LATEST#slurm-}$"; then + echo "Already have this version" + echo "new_release=false" >> $GITHUB_OUTPUT + else + echo "New release available!" + echo "new_release=true" >> $GITHUB_OUTPUT + fi + + - name: Create issue for new release + if: steps.check.outputs.new_release == 'true' + uses: actions/github-script@v7 + with: + script: | + const latest = '${{ steps.check.outputs.latest }}'; + await github.rest.issues.create({ + owner: context.repo.owner, + repo: context.repo.repo, + title: `New SLURM release available: ${latest}`, + body: `A new SLURM release is available upstream: ${latest}\n\nPlease update the Dockerfiles and create a new release.`, + labels: ['upstream-update'] + }); diff --git a/schedmd/slurm/25.05/rockylinux9/Dockerfile b/schedmd/slurm/25.05/rockylinux9/Dockerfile index df9799a..ec1d21c 100644 --- a/schedmd/slurm/25.05/rockylinux9/Dockerfile +++ b/schedmd/slurm/25.05/rockylinux9/Dockerfile @@ -129,7 +129,7 @@ dnf -q -y install --setopt='install_weak_deps=False' \ supervisor tini # Debug dnf -q -y install --setopt='install_weak_deps=False' \ - procps-ng iputils ncurses + procps-ng iputils ncurses openssl EOR ################################################################################ @@ -189,7 +189,7 @@ set -xeuo pipefail dnf -q -y install --setopt='install_weak_deps=False' \ gawk socat \ openssh-server \ - authselect sssd sssd-ad sssd-ldap \ + authselect sssd sssd-ad sssd-ldap sssd-client \ ./slurm-devel-[0-9]*.rpm \ ./slurm-libpmi-[0-9]*.rpm \ ./slurm-pam_slurm-[0-9]*.rpm \ @@ -329,7 +329,7 @@ set -xeuo pipefail dnf -q -y install --setopt='install_weak_deps=False' \ socat \ openssh-server \ - authselect sssd sssd-ad sssd-ldap + authselect sssd sssd-ad sssd-ldap sssd-client # Configure mkdir -p /etc/authselect authselect select sssd with-mkhomedir --force diff --git a/schedmd/slurm/25.05/rockylinux9/files/etc/supervisord.d/fakesystemd.ini b/schedmd/slurm/25.05/rockylinux9/files/etc/supervisord.d/fakesystemd.ini index 1a01459..952d492 100644 --- a/schedmd/slurm/25.05/rockylinux9/files/etc/supervisord.d/fakesystemd.ini +++ b/schedmd/slurm/25.05/rockylinux9/files/etc/supervisord.d/fakesystemd.ini @@ -9,3 +9,4 @@ stderr_logfile=/dev/stderr stdout_logfile_maxbytes=0 stderr_logfile_maxbytes=0 stopasgroup=true +priority=1 diff --git a/schedmd/slurm/25.05/rockylinux9/slurm.hcl b/schedmd/slurm/25.05/rockylinux9/slurm.hcl index 7ae76fb..28e09f2 100644 --- a/schedmd/slurm/25.05/rockylinux9/slurm.hcl +++ b/schedmd/slurm/25.05/rockylinux9/slurm.hcl @@ -3,6 +3,6 @@ ################################################################################ -slurm_version = "25.05.6" +slurm_version = "25.05.7" slurm_version_micro = "1" linux_flavor = "rockylinux9" diff --git a/schedmd/slurm/25.05/ubuntu24.04/Dockerfile b/schedmd/slurm/25.05/ubuntu24.04/Dockerfile index c26b2a4..55d8edc 100644 --- a/schedmd/slurm/25.05/ubuntu24.04/Dockerfile +++ b/schedmd/slurm/25.05/ubuntu24.04/Dockerfile @@ -108,7 +108,7 @@ apt-get -qq -y install --no-install-recommends \ supervisor tini # Debug apt-get -qq -y install --no-install-recommends \ - procps iputils-ping ncurses-bin + procps iputils-ping ncurses-bin openssl EOR ################################################################################ diff --git a/schedmd/slurm/25.05/ubuntu24.04/files/etc/supervisor/conf.d/fakesystemd.conf b/schedmd/slurm/25.05/ubuntu24.04/files/etc/supervisor/conf.d/fakesystemd.conf index 1a01459..952d492 100644 --- a/schedmd/slurm/25.05/ubuntu24.04/files/etc/supervisor/conf.d/fakesystemd.conf +++ b/schedmd/slurm/25.05/ubuntu24.04/files/etc/supervisor/conf.d/fakesystemd.conf @@ -9,3 +9,4 @@ stderr_logfile=/dev/stderr stdout_logfile_maxbytes=0 stderr_logfile_maxbytes=0 stopasgroup=true +priority=1 diff --git a/schedmd/slurm/25.05/ubuntu24.04/slurm.hcl b/schedmd/slurm/25.05/ubuntu24.04/slurm.hcl index 9d14678..d9fd86e 100644 --- a/schedmd/slurm/25.05/ubuntu24.04/slurm.hcl +++ b/schedmd/slurm/25.05/ubuntu24.04/slurm.hcl @@ -3,6 +3,6 @@ ################################################################################ -slurm_version = "25.05.6" +slurm_version = "25.05.7" slurm_version_micro = "1" linux_flavor = "ubuntu24.04" diff --git a/schedmd/slurm/25.11/rockylinux9/Dockerfile b/schedmd/slurm/25.11/rockylinux9/Dockerfile index 2017259..b2247df 100644 --- a/schedmd/slurm/25.11/rockylinux9/Dockerfile +++ b/schedmd/slurm/25.11/rockylinux9/Dockerfile @@ -127,7 +127,7 @@ dnf -q -y install --setopt='install_weak_deps=False' \ supervisor tini # Debug dnf -q -y install --setopt='install_weak_deps=False' \ - procps-ng iputils ncurses + procps-ng iputils ncurses openssl EOR ################################################################################ @@ -187,7 +187,7 @@ set -xeuo pipefail dnf -q -y install --setopt='install_weak_deps=False' \ gawk socat \ openssh-server \ - authselect sssd sssd-ad sssd-ldap \ + authselect sssd sssd-ad sssd-ldap sssd-client \ ./slurm-devel-[0-9]*.rpm \ ./slurm-libpmi-[0-9]*.rpm \ ./slurm-pam_slurm-[0-9]*.rpm \ @@ -325,7 +325,7 @@ set -xeuo pipefail dnf -q -y install --setopt='install_weak_deps=False' \ socat \ openssh-server \ - authselect sssd sssd-ad sssd-ldap + authselect sssd sssd-ad sssd-ldap sssd-client # Configure mkdir -p /etc/authselect authselect select sssd with-mkhomedir --force diff --git a/schedmd/slurm/25.11/rockylinux9/files/etc/supervisord.d/fakesystemd-slurm.ini b/schedmd/slurm/25.11/rockylinux9/files/etc/supervisord.d/fakesystemd-slurm.ini index 1f6fa62..e88a82c 100644 --- a/schedmd/slurm/25.11/rockylinux9/files/etc/supervisord.d/fakesystemd-slurm.ini +++ b/schedmd/slurm/25.11/rockylinux9/files/etc/supervisord.d/fakesystemd-slurm.ini @@ -9,4 +9,5 @@ stderr_logfile=/dev/stderr stdout_logfile_maxbytes=0 stderr_logfile_maxbytes=0 stopasgroup=true +priority=1 user=slurm diff --git a/schedmd/slurm/25.11/rockylinux9/files/etc/supervisord.d/fakesystemd.ini b/schedmd/slurm/25.11/rockylinux9/files/etc/supervisord.d/fakesystemd.ini index 1a01459..952d492 100644 --- a/schedmd/slurm/25.11/rockylinux9/files/etc/supervisord.d/fakesystemd.ini +++ b/schedmd/slurm/25.11/rockylinux9/files/etc/supervisord.d/fakesystemd.ini @@ -9,3 +9,4 @@ stderr_logfile=/dev/stderr stdout_logfile_maxbytes=0 stderr_logfile_maxbytes=0 stopasgroup=true +priority=1 diff --git a/schedmd/slurm/25.11/rockylinux9/slurm.hcl b/schedmd/slurm/25.11/rockylinux9/slurm.hcl index ea323ef..69dc963 100644 --- a/schedmd/slurm/25.11/rockylinux9/slurm.hcl +++ b/schedmd/slurm/25.11/rockylinux9/slurm.hcl @@ -3,6 +3,6 @@ ################################################################################ -slurm_version = "25.11.2" +slurm_version = "25.11.4" slurm_version_micro = "1" linux_flavor = "rockylinux9" diff --git a/schedmd/slurm/25.11/ubuntu24.04/Dockerfile b/schedmd/slurm/25.11/ubuntu24.04/Dockerfile index 67aa10a..3e7c0ae 100644 --- a/schedmd/slurm/25.11/ubuntu24.04/Dockerfile +++ b/schedmd/slurm/25.11/ubuntu24.04/Dockerfile @@ -4,7 +4,7 @@ ################################################################################ -ARG SLURM_VERSION=25.11-latest +ARG SLURM_VERSION=25.11.2 ARG SLURM_VERSION_MICRO=1 ARG SLURM_DIR=slurm ARG PARENT_IMAGE=ubuntu:24.04 @@ -53,14 +53,43 @@ apt-get -qq -y install --no-install-recommends \ EOR COPY --from=slurm-src /workspace/${SLURM_DIR} ${SLURM_DIR} +COPY --from=slurm-shared /scripts/s2n/build-and-install.sh /usr/local/bin/build-and-install-s2n.sh +COPY --from=slurm-shared /scripts/s2n/enable-slurm-debian-s2n.sh /usr/local/bin/enable-slurm-debian-s2n.sh + +# Build s2n-tls from source for TLS support +# Ref: https://slurm.schedmd.com/tls.html +RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ + --mount=type=cache,target=/var/lib/apt,sharing=locked </dev/null -( cd ${SLURM_DIR} && debuild -b -uc -us >/dev/null ) +mk-build-deps -ir --tool='apt-get -y -o Debug::pkgProblemResolver=yes --no-install-recommends' ${SLURM_DIR}/debian/control +# Set library path so configure's AC_RUN_IFELSE test can find libs2n.so +export LD_LIBRARY_PATH="/usr/local/lib:${LD_LIBRARY_PATH:-}" +( cd ${SLURM_DIR} && debuild -b -uc -us ) EOR ################################################################################ @@ -97,6 +126,10 @@ EOR COPY --from=build /tmp/*.deb /tmp/*.ddeb /tmp/ +# Copy s2n-tls shared libraries from build stage (required for tls_s2n.so plugin) +COPY --from=build /usr/local/lib/libs2n.so* /usr/local/lib/ +RUN ldconfig + RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ --mount=type=cache,target=/var/lib/apt,sharing=locked <> "${SLURM_RULES_FILE}" <<'EOF' + +override_dh_shlibdeps: + dh_shlibdeps --dpkg-shlibdeps-params=--ignore-missing-info +EOF +fi