Ticket 4083

Summary:	how to configure slurm to use credentials for elasticsearch
Product:	Slurm	Reporter:	HMS Research Computing <rc>
Component:	Accounting	Assignee:	Alejandro Sanchez <asanchezg>
Status:	RESOLVED INFOGIVEN	QA Contact:
Severity:	3 - Medium Impact
Priority:	---
Version:	17.02.2
Hardware:	Linux
OS:	Linux
See Also:	https://bugs.schedmd.com/show_bug.cgi?id=8333
Site:	Harvard Medical School	Slinky Site:	---
Alineos Sites:	---	Atos/Eviden Sites:	---
Confidential Site:	---	Coreweave sites:	---
Cray Sites:	---	DS9 clusters:	---
Google sites:	---	HPCnow Sites:	---
HPE Sites:	---	IBM Sites:	---
NOAA SIte:	---	NoveTech Sites:	---
Nvidia HWinf-CS Sites:	---	OCF Sites:	---
Recursion Pharma Sites:	---	SFW Sites:	---
SNIC sites:	---	Tzag Elita Sites:	---
Linux Distro:	---	Machine Name:
CLE Version:		Version Fixed:
Target Release:	---	DevPrio:	---
Emory-Cloud Sites:	---

Description HMS Research Computing 2017-08-16 10:11:03 MDT

Hi,

we installed x-pack security plugin on elasticsearch and slurm can't able to write data anymore
Is there a way to tell slurm to use credentials for writing data into elasticsearch

Thanks
Bhanu

Comment 1 Alejandro Sanchez 2017-08-17 05:12:58 MDT

Hi,

The current code of Slurm does not provide with the ability to specify credentials when sending a REST resquest for indexing jobs to the elasticsearch index 'slurm'.

This morning I've been doing some tests with the X-Pack Security plugin for Elasticsearch, and found two solutions for this problem.

1. Workaround with no change in the code:

Following these guidelines:

https://www.elastic.co/guide/en/x-pack/current/security-getting-started.html

You could setup a role to access a specific index pattern to a specific user. Then following these other guidelines:

https://www.elastic.co/guide/en/x-pack/current/anonymous-access.html

You could enable anonymous access (meaning no authentication token can be extracted from the incoming request) to specific users.

So what I did following these guidelines is to create a role to grant 'all' privileges to index 'slurm' and then enabled anonymous access to SlurmUser to that role. That way REST requests without credential can access the 'slurm' index for that user.

2. Another option is to reclassify this as a Sev-5 enhancement request. Absent some customer willing to sponsor development of such code refactor, or a contributed patch providing this expansion, I cannot say when or if this will be addressed. If Harvard is interested in discussing that further please let me know, and we can talk about that outside Bugzilla.

Regarding the design for that change, most probably it wouldn't be a big thing. Looking at the code I think it would require the addition of a new JobCompParams option to specify the credentials. Then from within the plugin we should check if the credentials are specified and if so, then use the libcurl library to setup authentication options to the REST request. Most probably through these opts:

https://curl.haxx.se/libcurl/c/CURLOPT_USERNAME.html
https://curl.haxx.se/libcurl/c/CURLOPT_PASSWORD.html

Please, let us know whether workaround 1) is enough to satisfy your needs, or if you want to discuss the Sev-5 option further otherwise. Thanks.

Comment 4 HMS Research Computing 2017-08-28 09:18:51 MDT

Alex,

I configured using method 1 you mentioned
you can resolve this request


Thanks,
Bhanu

Comment 5 Alejandro Sanchez 2017-08-28 09:43:27 MDT

(In reply to Research Computing from comment #4)
> Alex,
> 
> I configured using method 1 you mentioned
> you can resolve this request
> 
> 
> Thanks,
> Bhanu

Great, thanks for the feedback.