jlphillips/openldap-login repository overview

⁠OpenLDAP-Login

This image can be used to create login-enabled worker or scheduler HPC nodes: OpenLDAP client is used for authentication, Munge, OpenMPI and SLURM are preinstalled for job scheduling, and Singularity is preinstalled to allow arbitrary user-space container execution (HPC jobs using OpenMPI and/or Nvidia/GPUs). In short, an entire virtual cluster can be deployed in Docker and/or Kubernetes using this image for scheduler and worker components. (Nvidia/CUDA-tagged versions should be used for GPU-enabled clusters.)

⁠Deploying on Kubernetes

A minimal setup for Kubernetes which can be adapted to your specific cluster hardware is here: MTSU CS S-STEM Cloud Infrastructure 2020⁠. There are additional components included with the K8S deployment, namely a shared filesystem via an NFS server and an OpenLDAP server to handle authentication requests, in order to create a complete virtual cluster deployed over Kubernetes. Some familiarity with configuring SLURM/Munge for HPC is expected to customize the deployment. The built-in OpenLDAP server and/or the built-in NFS server can (and usually would) be replaced with existing infrastructure.

⁠Deploying a single instance with Docker

The image is primarily built for the Kubernetes use-case above, but customization of the image is possible by mounting the necessary (re)configuration files for any of the cluster components above (in their default locations on Ubuntu).

For example, just replacing /etc/ldap.conf and /etc/ldap.secret (needs permissions mode 0400) with an appropriate OpenLDAP client configuration will create a container that users can log into using via SSH and their OpenLDAP credentials.

⁠Security Concerns

The containers must be run in privileged mode in Docker or under a privileged Security Context under Kubernetes for users to be able to run Singularity containers (even when not root), and you should carefully investigate the security implications in your particular environment carefully before considering deploying containers with elevated privileges.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.