Restore openssl in Slurm runtime images

.github/workflows/build-slurm-images.yaml

@@ -0,0 +1,143 @@
+# SPDX-FileCopyrightText: Copyright (C) Vantage Compute, Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Build SLURM Images with s2n TLS
+
+on:
+  push:
+    branches:
+      - main
+      - 'feat/**'
+    tags:
+      - 'v*'
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      slurm_version:
+        description: 'SLURM version (e.g., 25.11.2, 25.11.1)'
+        required: false
+        default: '25.11.2'
+      push_images:
+        description: 'Push images to registry'
+        required: false
+        default: 'false'
+        type: boolean
+
+env:
+  REGISTRY: ghcr.io/vantagecompute
+  # Default to latest 25.11.x release
+  SLURM_VERSION: ${{ github.event.inputs.slurm_version || '25.11.2' }}
+
+jobs:
+  build-ubuntu2404:
+    name: Build Ubuntu 24.04 Images
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    strategy:
+      matrix:
+        target:
+          - slurmctld
+          - slurmdbd
+          - slurmrestd
+          - slurmd
+          - sackd
+          - login
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract version info
+        id: version
+        run: |
+          # Extract version from tag or use default
+          if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
+            VERSION="${{ github.ref_name }}"
+            VERSION="${VERSION#v}"  # Remove 'v' prefix
+          else
+            VERSION="${{ env.SLURM_VERSION }}"
+          fi
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+
+          # Generate image tags
+          TAGS="${{ env.REGISTRY }}/${{ matrix.target }}:${VERSION}-ubuntu24.04"
+          if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
+            TAGS="${TAGS},${{ env.REGISTRY }}/${{ matrix.target }}:latest-ubuntu24.04"
+          fi
+          echo "tags=${TAGS}" >> $GITHUB_OUTPUT
+
+      - name: Build and push ${{ matrix.target }}
+        uses: docker/build-push-action@v6
+        with:
+          context: schedmd/slurm/25.11/ubuntu24.04
+          file: schedmd/slurm/25.11/ubuntu24.04/Dockerfile
+          target: ${{ matrix.target }}
+          push: ${{ github.event_name != 'pull_request' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/feat/') || startsWith(github.ref, 'refs/tags/v') || github.event.inputs.push_images == 'true') }}
+          tags: ${{ steps.version.outputs.tags }}
+          build-args: |
+            SLURM_VERSION=${{ steps.version.outputs.version }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          labels: |
+            org.opencontainers.image.title=Vantage SLURM ${{ matrix.target }}
+            org.opencontainers.image.description=SLURM ${{ matrix.target }} with s2n TLS support
+            org.opencontainers.image.version=${{ steps.version.outputs.version }}
+            org.opencontainers.image.source=https://github.com/vantagecompute/slurm-containers
+            org.opencontainers.image.vendor=Vantage Compute, Inc.
+
+  # Check for new upstream releases (runs weekly)
+  check-upstream:
+    name: Check Upstream Releases
+    runs-on: ubuntu-latest
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Check for new SLURM releases
+        id: check
+        run: |
+          # Get latest release from SchedMD/slurm
+          LATEST=$(curl -s https://api.github.com/repos/SchedMD/slurm/releases/latest | jq -r .tag_name)
+          echo "Latest upstream SLURM release: ${LATEST}"
+          echo "latest=${LATEST}" >> $GITHUB_OUTPUT
+
+          # Check if we have this version tagged
+          if git tag -l | grep -q "^v${LATEST#slurm-}$"; then
+            echo "Already have this version"
+            echo "new_release=false" >> $GITHUB_OUTPUT
+          else
+            echo "New release available!"
+            echo "new_release=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Create issue for new release
+        if: steps.check.outputs.new_release == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const latest = '${{ steps.check.outputs.latest }}';
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: `New SLURM release available: ${latest}`,
+              body: `A new SLURM release is available upstream: ${latest}\n\nPlease update the Dockerfiles and create a new release.`,
+              labels: ['upstream-update']
+            });

schedmd/slurm/25.05/rockylinux9/Dockerfile

@@ -129,7 +129,7 @@ dnf -q -y install --setopt='install_weak_deps=False' \
   supervisor tini
 # Debug
 dnf -q -y install --setopt='install_weak_deps=False' \
-  procps-ng iputils ncurses
+  procps-ng iputils ncurses openssl
 EOR
 
 ################################################################################
@@ -189,7 +189,7 @@ set -xeuo pipefail
 dnf -q -y install --setopt='install_weak_deps=False' \
   gawk socat \
   openssh-server \
-  authselect sssd sssd-ad sssd-ldap \
+  authselect sssd sssd-ad sssd-ldap sssd-client \
   ./slurm-devel-[0-9]*.rpm \
   ./slurm-libpmi-[0-9]*.rpm \
   ./slurm-pam_slurm-[0-9]*.rpm \
@@ -329,7 +329,7 @@ set -xeuo pipefail
 dnf -q -y install --setopt='install_weak_deps=False' \
   socat \
   openssh-server \
-  authselect sssd sssd-ad sssd-ldap
+  authselect sssd sssd-ad sssd-ldap sssd-client
 # Configure
 mkdir -p /etc/authselect
 authselect select sssd with-mkhomedir --force

schedmd/slurm/25.05/rockylinux9/files/etc/supervisord.d/fakesystemd.ini

@@ -9,3 +9,4 @@ stderr_logfile=/dev/stderr
 stdout_logfile_maxbytes=0
 stderr_logfile_maxbytes=0
 stopasgroup=true
+priority=1

schedmd/slurm/25.05/rockylinux9/slurm.hcl

@@ -3,6 +3,6 @@
 
 ################################################################################
 
-slurm_version = "25.05.6"
+slurm_version = "25.05.7"
 slurm_version_micro = "1"
 linux_flavor = "rockylinux9"

schedmd/slurm/25.05/ubuntu24.04/Dockerfile

@@ -108,7 +108,7 @@ apt-get -qq -y install --no-install-recommends \
   supervisor tini
 # Debug
 apt-get -qq -y install --no-install-recommends \
-  procps iputils-ping ncurses-bin
+  procps iputils-ping ncurses-bin openssl
 EOR
 
 ################################################################################

schedmd/slurm/25.05/ubuntu24.04/files/etc/supervisor/conf.d/fakesystemd.conf

@@ -9,3 +9,4 @@ stderr_logfile=/dev/stderr
 stdout_logfile_maxbytes=0
 stderr_logfile_maxbytes=0
 stopasgroup=true
+priority=1

schedmd/slurm/25.05/ubuntu24.04/slurm.hcl

@@ -3,6 +3,6 @@
 
 ################################################################################
 
-slurm_version = "25.05.6"
+slurm_version = "25.05.7"
 slurm_version_micro = "1"
 linux_flavor = "ubuntu24.04"

schedmd/slurm/25.11/rockylinux9/Dockerfile

@@ -127,7 +127,7 @@ dnf -q -y install --setopt='install_weak_deps=False' \
   supervisor tini
 # Debug
 dnf -q -y install --setopt='install_weak_deps=False' \
-  procps-ng iputils ncurses
+  procps-ng iputils ncurses openssl
 EOR
 
 ################################################################################
@@ -187,7 +187,7 @@ set -xeuo pipefail
 dnf -q -y install --setopt='install_weak_deps=False' \
   gawk socat \
   openssh-server \
-  authselect sssd sssd-ad sssd-ldap \
+  authselect sssd sssd-ad sssd-ldap sssd-client \
   ./slurm-devel-[0-9]*.rpm \
   ./slurm-libpmi-[0-9]*.rpm \
   ./slurm-pam_slurm-[0-9]*.rpm \
@@ -325,7 +325,7 @@ set -xeuo pipefail
 dnf -q -y install --setopt='install_weak_deps=False' \
   socat \
   openssh-server \
-  authselect sssd sssd-ad sssd-ldap
+  authselect sssd sssd-ad sssd-ldap sssd-client
 # Configure
 mkdir -p /etc/authselect
 authselect select sssd with-mkhomedir --force

schedmd/slurm/25.11/rockylinux9/files/etc/supervisord.d/fakesystemd-slurm.ini

@@ -9,4 +9,5 @@ stderr_logfile=/dev/stderr
 stdout_logfile_maxbytes=0
 stderr_logfile_maxbytes=0
 stopasgroup=true
+priority=1
 user=slurm

schedmd/slurm/25.11/rockylinux9/files/etc/supervisord.d/fakesystemd.ini

@@ -9,3 +9,4 @@ stderr_logfile=/dev/stderr
 stdout_logfile_maxbytes=0
 stderr_logfile_maxbytes=0
 stopasgroup=true
+priority=1

schedmd/slurm/25.11/rockylinux9/slurm.hcl

@@ -3,6 +3,6 @@
 
 ################################################################################
 
-slurm_version = "25.11.2"
+slurm_version = "25.11.4"
 slurm_version_micro = "1"
 linux_flavor = "rockylinux9"

schedmd/slurm/25.11/ubuntu24.04/Dockerfile

@@ -4,7 +4,7 @@
 
 ################################################################################
 
-ARG SLURM_VERSION=25.11-latest
+ARG SLURM_VERSION=25.11.2
 ARG SLURM_VERSION_MICRO=1
 ARG SLURM_DIR=slurm
 ARG PARENT_IMAGE=ubuntu:24.04
@@ -53,14 +53,43 @@ apt-get -qq -y install --no-install-recommends \
 EOR
 
 COPY --from=slurm-src /workspace/${SLURM_DIR} ${SLURM_DIR}
+COPY --from=slurm-shared /scripts/s2n/build-and-install.sh /usr/local/bin/build-and-install-s2n.sh
+COPY --from=slurm-shared /scripts/s2n/enable-slurm-debian-s2n.sh /usr/local/bin/enable-slurm-debian-s2n.sh
+
+# Build s2n-tls from source for TLS support
+# Ref: https://slurm.schedmd.com/tls.html
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+  --mount=type=cache,target=/var/lib/apt,sharing=locked <<EOR
+# Install s2n-tls build dependencies
+set -xeuo pipefail
+apt-get -qq update
+apt-get -qq -y install --no-install-recommends \
+  cmake git ca-certificates libssl-dev
+EOR
+
+RUN <<EOR
+# Build and install s2n-tls
+set -xeuo pipefail
+/usr/local/bin/build-and-install-s2n.sh
+EOR
+
+# Patch debian/rules to add --with-s2n to dh_auto_configure options
+# The s2n library is installed to /usr/local, so we pass the explicit path
+# Also add override for dh_shlibdeps to ignore missing dependency info for libs2n.so
+RUN <<EOR
+set -xeuo pipefail
+/usr/local/bin/enable-slurm-debian-s2n.sh ${SLURM_DIR}
+EOR
 
 # Ref: https://slurm.schedmd.com/quickstart_admin.html#debuild
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
   --mount=type=cache,target=/var/lib/apt,sharing=locked <<EOR
-# Build Slurm
+# Build Slurm with s2n TLS support
 set -xeuo pipefail
-mk-build-deps -ir --tool='apt-get -y -o Debug::pkgProblemResolver=yes --no-install-recommends' ${SLURM_DIR}/debian/control >/dev/null
-( cd ${SLURM_DIR} && debuild -b -uc -us >/dev/null )
+mk-build-deps -ir --tool='apt-get -y -o Debug::pkgProblemResolver=yes --no-install-recommends' ${SLURM_DIR}/debian/control
+# Set library path so configure's AC_RUN_IFELSE test can find libs2n.so
+export LD_LIBRARY_PATH="/usr/local/lib:${LD_LIBRARY_PATH:-}"
+( cd ${SLURM_DIR} && debuild -b -uc -us )
 EOR
 
 ################################################################################
@@ -97,6 +126,10 @@ EOR
 
 COPY --from=build /tmp/*.deb /tmp/*.ddeb /tmp/
 
+# Copy s2n-tls shared libraries from build stage (required for tls_s2n.so plugin)
+COPY --from=build /usr/local/lib/libs2n.so* /usr/local/lib/
+RUN ldconfig
+
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
   --mount=type=cache,target=/var/lib/apt,sharing=locked <<EOR
 # Install Dependencies
@@ -108,7 +141,7 @@ apt-get -qq -y install --no-install-recommends \
   supervisor tini
 # Debug
 apt-get -qq -y install --no-install-recommends \
-  procps iputils-ping ncurses-bin
+  procps iputils-ping ncurses-bin openssl
 EOR
 
 ################################################################################

schedmd/slurm/25.11/ubuntu24.04/files/etc/supervisor/conf.d/fakesystemd-slurm.conf

@@ -9,4 +9,5 @@ stderr_logfile=/dev/stderr
 stdout_logfile_maxbytes=0
 stderr_logfile_maxbytes=0
 stopasgroup=true
+priority=1
 user=slurm

schedmd/slurm/25.11/ubuntu24.04/files/etc/supervisor/conf.d/fakesystemd.conf

@@ -9,3 +9,4 @@ stderr_logfile=/dev/stderr
 stdout_logfile_maxbytes=0
 stderr_logfile_maxbytes=0
 stopasgroup=true
+priority=1

schedmd/slurm/25.11/ubuntu24.04/slurm.hcl

@@ -3,6 +3,6 @@
 
 ################################################################################
 
-slurm_version = "25.11.2"
+slurm_version = "25.11.4"
 slurm_version_micro = "1"
 linux_flavor = "ubuntu24.04"

schedmd/slurm/docker-bake.hcl

@@ -4,7 +4,7 @@
 ################################################################################
 
 variable "REGISTRY" {
-  default = "ghcr.io/slinkyproject"
+  default = "ghcr.io/vantagecompute"
 }
 
 variable "SUFFIX" {}
@@ -45,6 +45,9 @@ target "_slurm" {
     SLURM_VERSION = slurm_version
     SLURM_VERSION_MICRO = slurm_version_micro
   }
+  contexts = {
+    "slurm-shared" = "."
+  }
   labels = {
     # Ref: https://github.com/opencontainers/image-spec/blob/v1.0/annotations.md
     "org.opencontainers.image.authors" = "slinky@schedmd.com"

schedmd/slurm/master/rockylinux9/Dockerfile

@@ -127,7 +127,7 @@ dnf -q -y install --setopt='install_weak_deps=False' \
   supervisor tini
 # Debug
 dnf -q -y install --setopt='install_weak_deps=False' \
-  procps-ng iputils ncurses
+  procps-ng iputils ncurses openssl
 EOR
 
 ################################################################################
@@ -187,7 +187,7 @@ set -xeuo pipefail
 dnf -q -y install --setopt='install_weak_deps=False' \
   gawk socat \
   openssh-server \
-  authselect sssd sssd-ad sssd-ldap \
+  authselect sssd sssd-ad sssd-ldap sssd-client \
   ./slurm-devel-[0-9]*.rpm \
   ./slurm-libpmi-[0-9]*.rpm \
   ./slurm-pam_slurm-[0-9]*.rpm \
@@ -324,7 +324,7 @@ set -xeuo pipefail
 dnf -q -y install --setopt='install_weak_deps=False' \
   socat \
   openssh-server \
-  authselect sssd sssd-ad sssd-ldap
+  authselect sssd sssd-ad sssd-ldap sssd-client
 # Configure
 mkdir -p /etc/authselect
 authselect select sssd with-mkhomedir --force