New chaperones

.circleci/config.yml

@@ -1,10 +1,8 @@
 ---
-
-# Python CircleCI 2.0 configuration file
 #
-# Check https://circleci.com/docs/2.0/language-python/ for more details
+# Python CircleCI 2.0 configuration file
+# Check https://circleci.com/docs/2.0/language-python/ for more details.
 #
-
 version: 2.1
 jobs:
   build:

group_vars/betabarrel_cluster/vars.yml

@@ -222,6 +222,49 @@ regular_users:
   - user: 'umcg-vipt-dm'
     groups: ['umcg-vipt', "{{ functional_users_group }}"]
     sudoers: '%umcg-vipt'
+remote_users_in_local_groups:
+  - user: 'benjaminsm'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'bijlsmam'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'cimermans'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'langek'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'kanningaroj'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'neerincxp'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'vriesgb'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
 #
 # Shared storage related variables
 #

group_vars/copperfist_cluster/vars.yml

@@ -222,6 +222,49 @@ regular_users:
   - user: 'umcg-vipt-dm'
     groups: ['umcg-vipt', "{{ functional_users_group }}"]
     sudoers: '%umcg-vipt'
+remote_users_in_local_groups:
+  - user: 'benjaminsm'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'bijlsmam'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'cimermans'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'langek'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'kanningaroj'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'neerincxp'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'vriesgb'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
 #
 # Shared storage related variables
 #

group_vars/deploy_admin_interface.yml

@@ -1,6 +1,6 @@
 ---
 volumes:
-  - mount_point: '/apps'
+  - mount_point: "{{ hpc_env_prefix }}"
     device: '/dev/vdb'
     mounted_owner: root
     mounted_group: "{{ envsync_group }}"

group_vars/wingedhelix_cluster/vars.yml

@@ -235,6 +235,49 @@ regular_users:
   - user: 'umcg-vipt-dm'
     groups: ['umcg-vipt', "{{ functional_users_group }}"]
     sudoers: '%umcg-vipt'
+remote_users_in_local_groups:
+  - user: 'benjaminsm'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'bijlsmam'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'cimermans'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'langek'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'kanningaroj'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'neerincxp'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
+  - user: 'vriesgb'
+    groups: [
+        "{{ envsync_group }}", 'umcg-atd', 'umcg-gsad', 'umcg-gst',
+        'umcg-gap', 'umcg-gd', 'umcg-genomescan',
+        'umcg-labgnkbh', 'umcg-patho', 'umcg-vipt',
+    ]
 #
 # Shared storage related variables
 #

lor-init

@@ -15,8 +15,6 @@
 #     $> lor-config tl
 #
 
-set -u
-
 #
 ##
 ### Environment and bash sanity.
@@ -31,6 +29,13 @@ export LOR_DIR="$( cd -P "$( dirname "${BASH_SOURCE:-}" )" && pwd )"
 #
 
 function lor-config() {
+	local _opt_nounset_was_enbled
+	if [[ -o nounset ]]; then
+		_opt_nounset_was_enbled='true'
+	else
+		_opt_nounset_was_enbled='false'
+		set -u
+	fi
 	#
 	# Get and check input.
 	#
@@ -98,4 +103,7 @@ function lor-config() {
 		printf 'WARNING: Could not find Mitogen strategy plugin in %s\n' "${_ansible_mitogen_search_path}"
 		printf 'INFO: Mitogen strategy plugin is:        %s.\n' 'disabled (default)'
 	fi
+	if [[ "${_opt_nounset_was_enbled}" == 'false' ]]; then
+		set +u
+	fi
 }

roles/build_environment/defaults/main.yml

@@ -59,4 +59,14 @@ build_env_dai_deps:
   - 'python-pep8'
   - 'python3'
   - 'python3-pip'
+build_env_chaperone_deps:
+  - 'bzip2'
+  - 'gcc'
+  - 'git'
+  - 'nano'
+  - 'openssl'
+  - 'rsync'
+  - 'tcl-devel'
+  - 'unzip'
+  - 'wget'
 ...

roles/build_environment/tasks/main.yml

@@ -5,6 +5,9 @@
 # The DAI requires additional packages for compiling Slurm, Lmod, Lua, Ansible, etc.,
 # which users won't need.
 #
+# On chaperones we need a minimal build invironment too in order to deploy software
+# with the playbooks from the ansible-pipeline repo.
+#
 ---
 - name: Install generic build environment packages on UIs and DAIs.
   ansible.builtin.import_tasks: build_dependencies.yml
@@ -19,4 +22,11 @@
     mandatory_deps: "{{ build_env_dai_deps }}"
     optional_deps: []
   when: inventory_hostname in groups['deploy_admin_interface']
+
+- name: Install minimal build environment packages on chaperones.
+  ansible.builtin.import_tasks: build_dependencies.yml
+  vars:
+    mandatory_deps: "{{ build_env_chaperone_deps }}"
+    optional_deps: []
+  when: inventory_hostname in groups['chaperone']
 ...

roles/envsync/tasks/main.yml

@@ -34,6 +34,19 @@
         create_home: false
       become: false
 
+- name: "Create {{ hpc_env_prefix }} folder on root partition unless the machine already has a dedicated mount for {{ hpc_env_prefix }}."
+  ansible.builtin.file:
+    path: "{{ hpc_env_prefix }}"
+    state: directory
+    owner: root
+    group: "{{ envsync_group }}"
+    mode: '2775'
+  when: volumes | default([])
+        | selectattr('mount_point', 'defined')
+        | selectattr('mount_point', 'equalto', hpc_env_prefix)
+        | length <= 0
+  become: true
+
 #
 # Configure environment synchronization account.
 #

roles/regular_users/tasks/main.yml

@@ -23,4 +23,12 @@
       inventory_hostname in groups['chaperone'] | default([]) or
       inventory_hostname in groups['data_transfer'] | default([])
     - ldap_domains['stack']['replication_provider_uri'] is not defined
+
+- name: 'Add remote regular users to local groups.'
+  ansible.builtin.include_tasks:
+    file: remote_users_in_local_groups.yml
+  when:
+    - inventory_hostname in groups['chaperone'] | default([])
+    - remote_users_in_local_groups is defined
+
 ...

roles/regular_users/tasks/remote_users_in_local_groups.yml

@@ -0,0 +1,9 @@
+---
+- name: 'Add regular users from an LDAP/AD to local groups.'
+  ansible.builtin.user:
+    name: "{{ item.user }}"
+    groups: "{{ item.groups }}"
+    append: true
+  with_items: "{{ remote_users_in_local_groups }}"
+  become: true
+...

single_group_playbooks/chaperone.yml

@@ -5,10 +5,10 @@
 - name: '###==-> Roles for chaperones. <-==###'
   hosts:
     - chaperone
-  connection: local
   roles:
     - regular_users
     - shared_storage
     - sudoers
+    - build_environment
     - envsync
 ...

single_role_playbooks/envsync.yml

@@ -1,11 +1,7 @@
 ---
 - hosts:
     - deploy_admin_interface
-  roles:
-    - envsync
-- hosts:
     - chaperone
-  connection: local
   roles:
     - envsync
 ...

single_role_playbooks/regular_users.yml

@@ -3,11 +3,7 @@
   hosts:
     - jumphost
     - cluster
-  roles:
-    - regular_users
-- hosts:
     - chaperone
-  connection: local
   roles:
     - regular_users
 ...

single_role_playbooks/shared_storage.yml

@@ -1,11 +1,7 @@
 ---
 - hosts:
     - cluster
-  roles:
-    - shared_storage
-- hosts:
     - chaperone
-  connection: local
   roles:
     - shared_storage
 ...

single_role_playbooks/sudoers.yml

@@ -1,11 +1,7 @@
 ---
 - hosts:
     - user_interface
-  roles:
-    - sudoers
-- hosts:
     - chaperone
-  connection: local
   roles:
     - sudoers
 ...