Ticket 2024

Summary: How to restrict user access to partitions
Product: Slurm Reporter: CERFACS <csg>
Component: ConfigurationAssignee: David Bigagli <david>
Status: RESOLVED INFOGIVEN QA Contact:
Severity: 4 - Minor Issue    
Priority: --- CC: alex.mamach, brian, da
Version: 14.11.4   
Hardware: Linux   
OS: Linux   
Site: CERFACS Slinky Site: ---
Alineos Sites: --- Atos/Eviden Sites: ---
Confidential Site: --- Coreweave sites: ---
Cray Sites: --- DS9 clusters: ---
Google sites: --- HPCnow Sites: ---
HPE Sites: --- IBM Sites: ---
NOAA SIte: --- NoveTech Sites: ---
Nvidia HWinf-CS Sites: --- OCF Sites: ---
Recursion Pharma Sites: --- SFW Sites: ---
SNIC sites: --- Tzag Elita Sites: ---
Linux Distro: --- Machine Name:
CLE Version: Version Fixed:
Target Release: --- DevPrio: ---
Emory-Cloud Sites: ---

Description CERFACS 2015-10-12 19:10:14 MDT 
I would like to create 2 news partitions on my cluster where only some users are allowed to run their jobs : for example,

partition1 : user1, user2, user3
partition2 : user4, user5

I would like to know what is the best way to implement this functionnality.
Do i need to associate  for each user the list of partitions where he is able
to run or is it possible to make something more clever?
 
Is it possible to update an existing user with sacctmgr command to give it access to a new partition without deleting it and then recreate?


In my cluster, all users have the same permission.
Thanks a lot in advance for your help.

Regards,
Isabelle
Comment 1 David Bigagli 2015-10-12 20:11:19 MDT 
Hello have you look at the AllowPartition parameter in slurm.conf.

http://slurm.schedmd.com/slurm.conf.html

David
Comment 2 CERFACS 2015-10-12 20:52:53 MDT 
Hi David

I do not find any AllowPartition parameter in slurm.conf documentation. 
Do you mean AllowGroups ?

Thanks.
Isabelle
Comment 3 David Bigagli 2015-10-12 21:28:13 MDT 
Sorry for the confusion indeed I mistyped it. Should be AllowedGroups, the list
of user groups that are allowed to submit jobs to a given partition.

David
Comment 4 David Bigagli 2015-10-12 21:33:59 MDT 
Sorry for the confusion indeed I mistyped it. Should be AllowedGroups, the list
of user groups that are allowed to submit jobs to a given partition.

David
Comment 5 CERFACS 2015-10-12 22:22:19 MDT 
David,

Could you please tell me if this AllowGroups corresponds to accounts defined in slurm with the command 
sacctmgr create account name=group1

or is it refering to unix group?

Thanks for your reply.
Isabelle
Comment 6 David Bigagli 2015-10-12 22:38:18 MDT 
It is referring to unix groups.

David
Comment 7 CERFACS 2015-10-12 22:43:08 MDT 
David,

So it is not really what i need, because,i would like to give access to a subset of users belonging to the same unix group. 

Isabelle
Comment 8 David Bigagli 2015-10-13 00:06:19 MDT 
Hi,
   can you split the groups? Alternatively you can create users
specifying partition they have access to using the sacctmgr command.
For example:

sacctmgr update user david account=sys set partition=giove

then you have to use AccountingStorageEnforce=associations in your slurm.conf.
After reconfiguring the user david can only submit jobs to partition giove,
attempts to use other partition will be rejected.

David
Comment 9 CERFACS 2015-10-13 01:43:28 MDT 
Is it possible to add partition to already existing users?
I am trying to add the partition bigmem to user dast but i get
an error :

# sacctmgr update user dast account=default set partition=bigmem
 Unknown option: partition=bigmem
 Use keyword 'where' to modify condition

Thanks.
Isabelle
Comment 10 David Bigagli 2015-10-13 01:45:45 MDT 
It is my understanding that you can only do it when the user is added.

David
Comment 11 David Bigagli 2015-10-13 02:01:41 MDT 
One of my colleagues pointed out that you could also use a submission plugin
to validate which user can submit to what partition.

You can read about submission plugin in the slurm.conf man page in the
JobSubmitPlugins paragraph.

David
Comment 12 CERFACS 2015-10-13 03:33:15 MDT 
David,

I have created a new unix group called bigprod and associate the partition bigprod with this group with the parameter AllowGroups=bigprod in slurm.conf file



I belong to this group (but as secondary group)
 [dast@nemo1 ~]$ groups
info bigprod

[dast@nemo1 ~]$  salloc --partition bigprod
salloc: error: Job submit/allocate failed: Invalid account or account/partition combination specified

but my request is rejected when i want to use this partition. Does it
mean the group should be only the primary unix group and not a secondary one?


Thanks.
Isabelle
Comment 13 CERFACS 2015-10-13 03:36:17 MDT 
Sorry, just forgot my last comment... 
It is working, it was just that i have not well declared the association on my account.


So, i will use this method of group to restrict partition access.

Thanks a lot for your help.
Regards
Isabelle
Comment 14 David Bigagli 2015-10-13 20:27:06 MDT 
Good to know it is working. Let us know if you have any other question.

David
Comment 15 David Bigagli 2015-10-13 22:39:22 MDT 
Info given.

David
Comment 16 Alex Mamach 2019-09-27 12:29:11 MDT 
Info given, safe to update