Container Service for Kubernetes:Deploy containerized Slurm on ACK

Slurm

Slurm is an open-source cluster resource management and job scheduling platform for supercomputers and large compute clusters. The following figure shows how Slurm works.

• slurmctld (Slurm Control Daemon): The central controller that monitors resources, schedules jobs, and manages cluster state. Configure a standby slurmctld for high availability.

• slurmd (Slurm Node Daemon): Runs on each compute node to receive instructions from slurmctld, execute jobs, and report status.

• slurmdbd (Slurm Database Daemon): An optional component that maintains a centralized database for job history and accounting. Supports data aggregation across multiple Slurm-managed clusters.

• SlurmCLI: Command-line tools for job management and system monitoring:

  • scontrol: Manages cluster configuration and state.

  • squeue: Queries the status of the job queue.

  • srun: Submits and manages jobs.

  • sbatch: Submits a batch job.

  • sinfo: Displays cluster state and node availability.

Slurm on ACK

The Slurm Operator uses the SlurmCluster CustomResource (CR) to deploy and manage Slurm clusters. An administrator creates a SlurmCluster object, and the operator provisions the control plane components. Mount configuration files through shared storage or a ConfigMap. The following figure shows the architecture of Slurm on ACK.

For Kubernetes cluster administrators

Kubernetes cluster administrators can use kubectl to log on to any pod in the Slurm-managed cluster, which grants root permissions within Slurm.

Log on to any pod of the Slurm-managed cluster.

# Replace slurm-job-demo-xxxxx with the name of a specific pod in your cluster.
kubectl exec -it slurm-job-demo-xxxxx -- bash

For regular Slurm cluster users

Users without kubectl exec permissions must log on to the Slurm-managed cluster through SSH.

• A Service external IP provides persistent access through a load balancer, accessible from anywhere within your internal network.

• Port forwarding is a temporary solution for debugging, as kubectl port-forward must run continuously.

User synchronization across nodes

Slurm lacks built-in centralized user authentication. Jobs submitted with sbatch fail if the user account does not exist on the target node. Configure LDAP as a centralized authentication backend to resolve this.

1. Create a file named ldap.yaml with the following content to deploy a basic LDAP service.

   The ldap.yaml file defines a pod for the LDAP service and a Service to expose it.

   LDAP backend Pod and Service

   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     namespace: default
     name: ldap
     labels:
       app: ldap
   spec:
     selector:
       matchLabels:
         app: ldap
     revisionHistoryLimit: 10
     template:
       metadata:
         labels:
           app: ldap
       spec:
         securityContext:
           seLinuxOptions: {}
         imagePullSecrets: []
         restartPolicy: Always
         initContainers: []
         containers:
           - image: 'osixia/openldap:1.4.0'
             imagePullPolicy: IfNotPresent
             name: ldap
             volumeMounts:
               - name: openldap-data
                 mountPath: /var/lib/ldap
                 subPath: data
               - name: openldap-data
                 mountPath: /etc/ldap/slapd.d
                 subPath: config
               - name: openldap-data
                 mountPath: /container/service/slapd/assets/certs
                 subPath: certs
               - name: secret-volume
                 mountPath: /container/environment/01-custom
               - name: container-run
                 mountPath: /container/run
             args:
               - '--copy-service'
             resources:
               limits:
               requests:
             env: []
             readinessProbe:
               tcpSocket:
                 port: openldap
               initialDelaySeconds: 20
               timeoutSeconds: 1
               periodSeconds: 10
               successThreshold: 1
               failureThreshold: 10
             livenessProbe:
               tcpSocket:
                 port: openldap
               initialDelaySeconds: 20
               timeoutSeconds: 1
               periodSeconds: 10
               successThreshold: 1
               failureThreshold: 10
             lifecycle: {}
             ports:
               - name: openldap
                 containerPort: 389
                 protocol: TCP
               - name: ssl-ldap-port
                 containerPort: 636
                 protocol: TCP
         volumes:
           - name: openldap-data
             emptyDir: {}
           - name: secret-volume
             secret:
               secretName: ldap-secret
               defaultMode: 420
               items: []
           - name: container-run
             emptyDir: {}
         dnsPolicy: ClusterFirst
         dnsConfig: {}
         terminationGracePeriodSeconds: 30
     progressDeadlineSeconds: 600
     strategy:
       type: RollingUpdate
       rollingUpdate:
         maxUnavailable: 25%
         maxSurge: 25%
     replicas: 1
   ---
   apiVersion: v1
   kind: Service
   metadata:
     annotations: {}
     labels:
       app: ldap
     name: ldap-service
     namespace: default
   spec:
     ports:
       - name: openldap
         port: 389
         protocol: TCP
         targetPort: openldap
       - name: ssl-ldap-port
         port: 636
         protocol: TCP
         targetPort: ssl-ldap-port
     selector:
       app: ldap
     sessionAffinity: None
     type: ClusterIP
   ---
   metadata:
     name: ldap-secret
     namespace: default
     annotations: {}
   data:
     env.startup.yaml: >-
       IyBUaGlzIGlzIHRoZSBkZWZhdWx0IGltYWdlIHN0YXJ0dXAgY29uZmlndXJhdGlvbiBmaWxlCiMgdGhpcyBmaWxlIGRlZmluZSBlbnZpcm9ubWVudCB2YXJpYWJsZXMgdXNlZCBkdXJpbmcgdGhlIGNvbnRhaW5lciAqKmZpcnN0IHN0YXJ0KiogaW4gKipzdGFydHVwIGZpbGVzKiouCgojIFRoaXMgZmlsZSBpcyBkZWxldGVkIHJpZ2h0IGFmdGVyIHN0YXJ0dXAgZmlsZXMgYXJlIHByb2Nlc3NlZCBmb3IgdGhlIGZpcnN0IHRpbWUsCiMgYWZ0ZXIgdGhhdCBhbGwgdGhlc2UgdmFsdWVzIHdpbGwgbm90IGJlIGF2YWlsYWJsZSBpbiB0aGUgY29udGFpbmVyIGVudmlyb25tZW50LgojIFRoaXMgaGVscHMgdG8ga2VlcCB5b3VyIGNvbnRhaW5lciBjb25maWd1cmF0aW9uIHNlY3JldC4KIyBtb3JlIGluZm9ybWF0aW9uIDogaHR0cHM6Ly9naXRodWIuY29tL29zaXhpYS9kb2NrZXItbGlnaHQtYmFzZWltYWdlCgojIFJlcXVpcmVkIGFuZCB1c2VkIGZvciBuZXcgbGRhcCBzZXJ2ZXIgb25seQpMREFQX09SR0FOSVNBVElPTjogRXhhbXBsZSBJbmMuCkxEQVBfRE9NQUlOOiBleGFtcGxlLm9yZwpMREFQX0JBU0VfRE46ICNpZiBlbXB0eSBhdXRvbWF0aWNhbGx5IHNldCBmcm9tIExEQVBfRE9NQUlOCgpMREFQX0FETUlOX1BBU1NXT1JEOiBhZG1pbgpMREFQX0NPTkZJR19QQVNTV09SRDogY29uZmlnCgpMREFQX1JFQURPTkxZX1VTRVI6IGZhbHNlCkxEQVBfUkVBRE9OTFlfVVNFUl9VU0VSTkFNRTogcmVhZG9ubHkKTERBUF9SRUFET05MWV9VU0VSX1BBU1NXT1JEOiByZWFkb25seQoKIyBCYWNrZW5kCkxEQVBfQkFDS0VORDogaGRiCgojIFRscwpMREFQX1RMUzogdHJ1ZQpMREFQX1RMU19DUlRfRklMRU5BTUU6IGxkYXAuY3J0CkxEQVBfVExTX0tFWV9GSUxFTkFNRTogbGRhcC5rZXkKTERBUF9UTFNfQ0FfQ1JUX0ZJTEVOQU1FOiBjYS5jcnQKCkxEQVBfVExTX0VORk9SQ0U6IGZhbHNlCkxEQVBfVExTX0NJUEhFUl9TVUlURTogU0VDVVJFMjU2Oi1WRVJTLVNTTDMuMApMREFQX1RMU19QUk9UT0NPTF9NSU46IDMuMQpMREFQX1RMU19WRVJJRllfQ0xJRU5UOiBkZW1hbmQKCiMgUmVwbGljYXRpb24KTERBUF9SRVBMSUNBVElPTjogZmFsc2UKIyB2YXJpYWJsZXMgJExEQVBfQkFTRV9ETiwgJExEQVBfQURNSU5fUEFTU1dPUkQsICRMREFQX0NPTkZJR19QQVNTV09SRAojIGFyZSBhdXRvbWF0aWNhbHkgcmVwbGFjZWQgYXQgcnVuIHRpbWUKCiMgaWYgeW91IHdhbnQgdG8gYWRkIHJlcGxpY2F0aW9uIHRvIGFuIGV4aXN0aW5nIGxkYXAKIyBhZGFwdCBMREFQX1JFUExJQ0FUSU9OX0NPTkZJR19TWU5DUFJPViBhbmQgTERBUF9SRVBMSUNBVElPTl9EQl9TWU5DUFJPViB0byB5b3VyIGNvbmZpZ3VyYXRpb24KIyBhdm9pZCB1c2luZyAkTERBUF9CQVNFX0ROLCAkTERBUF9BRE1JTl9QQVNTV09SRCBhbmQgJExEQVBfQ09ORklHX1BBU1NXT1JEIHZhcmlhYmxlcwpMREFQX1JFUExJQ0FUSU9OX0NPTkZJR19TWU5DUFJPVjogYmluZGRuPSJjbj1hZG1pbixjbj1jb25maWciIGJpbmRtZXRob2Q9c2ltcGxlIGNyZWRlbnRpYWxzPSRMREFQX0NPTkZJR19QQVNTV09SRCBzZWFyY2hiYXNlPSJjbj1jb25maWciIHR5cGU9cmVmcmVzaEFuZFBlcnNpc3QgcmV0cnk9IjYwICsiIHRpbWVvdXQ9MSBzdGFydHRscz1jcml0aWNhbApMREFQX1JFUExJQ0FUSU9OX0RCX1NZTkNQUk9WOiBiaW5kZG49ImNuPWFkbWluLCRMREFQX0JBU0VfRE4iIGJpbmRtZXRob2Q9c2ltcGxlIGNyZWRlbnRpYWxzPSRMREFQX0FETUlOX1BBU1NXT1JEIHNlYXJjaGJhc2U9IiRMREFQX0JBU0VfRE4iIHR5cGU9cmVmcmVzaEFuZFBlcnNpc3QgaW50ZXJ2YWw9MDA6MDA6MDA6MTAgcmV0cnk9IjYwICsiIHRpbWVvdXQ9MSBzdGFydHRscz1jcml0aWNhbApMREFQX1JFUExJQ0FUSU9OX0hPU1RTOgogIC0gbGRhcDovL2xkYXAuZXhhbXBsZS5vcmcgIyBUaGUgb3JkZXIgbXVzdCBiZSB0aGUgc2FtZSBvbiBhbGwgbGRhcCBzZXJ2ZXJzCiAgLSBsZGFwOi8vbGRhcDIuZXhhbXBsZS5vcmcKCgojIFJlbW92ZSBjb25maWcgYWZ0ZXIgc2V0dXAKTERBUF9SRU1PVkVfQ09ORklHX0FGVEVSX1NFVFVQOiB0cnVlCgojIGNmc3NsIGVudmlyb25tZW50IHZhcmlhYmxlcyBwcmVmaXgKTERBUF9DRlNTTF9QUkVGSVg6IGxkYXAgIyBjZnNzbC1oZWxwZXIgZmlyc3Qgc2VhcmNoIGNvbmZpZyBmcm9tIExEQVBfQ0ZTU0xfKiB2YXJpYWJsZXMsIGJlZm9yZSBDRlNTTF8qIHZhcmlhYmxlcy4K
     env.yaml: >-
       IyBUaGlzIGlzIHRoZSBkZWZhdWx0IGltYWdlIGNvbmZpZ3VyYXRpb24gZmlsZQojIFRoZXNlIHZhbHVlcyB3aWxsIHBlcnNpc3RzIGluIGNvbnRhaW5lciBlbnZpcm9ubWVudC4KCiPCoEFsbCBlbnZpcm9ubWVudCB2YXJpYWJsZXMgdXNlZCBhZnRlciB0aGUgY29udGFpbmVyIGZpcnN0IHN0YXJ0CiMgbXVzdCBiZSBkZWZpbmVkIGhlcmUuCiMgbW9yZSBpbmZvcm1hdGlvbiA6IGh0dHBzOi8vZ2l0aHViLmNvbS9vc2l4aWEvZG9ja2VyLWxpZ2h0LWJhc2VpbWFnZQoKIyBHZW5lcmFsIGNvbnRhaW5lciBjb25maWd1cmF0aW9uCiMgc2VlIHRhYmxlIDUuMSBpbiBodHRwOi8vd3d3Lm9wZW5sZGFwLm9yZy9kb2MvYWRtaW4yNC9zbGFwZGNvbmYyLmh0bWwgZm9yIHRoZSBhdmFpbGFibGUgbG9nIGxldmVscy4KTERBUF9MT0dfTEVWRUw6IDI1Ngo=
   type: Opaque
   kind: Secret
   apiVersion: v1
   

2. Deploy the LDAP backend service:

   kubectl apply -f ldap.yaml

   Expected output:

   deployment.apps/ldap created
   service/ldap-service created
   secret/ldap-secret created

3. (Optional) Deploy a frontend interface for improved management. Create a file named phpldapadmin.yaml with the following content.

   LDAP frontend Pod and Service

   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     namespace: default
     name: phpldapadmin
     labels:
       io.kompose.service: phpldapadmin
   spec:
     selector:
       matchLabels:
         io.kompose.service: phpldapadmin
     revisionHistoryLimit: 10
     template:
       metadata:
         labels:
           io.kompose.service: phpldapadmin
       spec:
         securityContext:
           seLinuxOptions: {}
         imagePullSecrets: []
         restartPolicy: Always
         initContainers: []
         containers:
           - image: 'osixia/phpldapadmin:0.9.0'
             imagePullPolicy: Always
             name: phpldapadmin
             volumeMounts: []
             resources:
               limits:
               requests:
             env:
               - name: PHPLDAPADMIN_HTTPS
                 value: 'false'
               - name: PHPLDAPADMIN_LDAP_HOSTS
                 value: ldap-service
             lifecycle: {}
             ports:
               - containerPort: 80
                 protocol: TCP
         volumes: []
         dnsPolicy: ClusterFirst
         dnsConfig: {}
         terminationGracePeriodSeconds: 30
     progressDeadlineSeconds: 600
     strategy:
       type: RollingUpdate
       rollingUpdate:
         maxUnavailable: 25%
         maxSurge: 25%
     replicas: 1
   ---
   apiVersion: v1
   kind: Service
   metadata:
     namespace: default
     name: phpldapadmin
     annotations:
       k8s.kuboard.cn/workload: phpldapadmin
     labels:
       io.kompose.service: phpldapadmin
   spec:
     selector:
       io.kompose.service: phpldapadmin
     type: ClusterIP
     ports:
       - port: 8080
         targetPort: 80
         protocol: TCP
         name: '8080'
         nodePort: 0
     sessionAffinity: None

   Deploy the LDAP frontend service:

   kubectl apply -f phpldapadmin.yaml

4. Log on to a SlurmCluster pod as described in Step 3, then install the LDAP client package:

   apt update
   apt install libnss-ldapd

5. After installing libnss-ldapd, configure the network authentication service from within the pod.

   1. Install Vim for editing scripts and files:

      apt update
      apt install vim

   2. Configure the LDAP client in /etc/ldap/ldap.conf:

      ...
      BASE	dc=example,dc=org # Replace this with the base DN of your LDAP directory.
      URI	ldap://ldap-service # Replace this with the address of your LDAP server.
      ...

   3. Define the LDAP server connection in /etc/nslcd.conf:

      ...
      uri ldap://ldap-service # Replace this with the address of your LDAP server.
      base dc=example,dc=org # Set this based on your LDAP directory structure.
      ...
      tls_cacertfile /etc/ssl/certs/ca-certificates.crt # Specifies the path to the CA certificate file used to verify the LDAP server certificate.
      ...

Log sharing and access

By default, sbatch job logs are stored on the node where the job runs. Create a NAS file system to centralize log storage across all nodes.

1. Create a NAS file system to store and share logs from all nodes.

2. Log on to the ACK console and create a PV and PVC for the NAS file system. See Use a statically provisioned NAS volume.

3. Modify the SlurmCluster CR.

   Add volumeMounts and volumes to headGroupSpec and each workerGroupSpec to mount the PVC to /home:

   headGroupSpec:
   ...
   # Add a volume mount for /home.
     volumeMounts:
     - mountPath: /home
       name: test  # The name of the volume that references the PVC.
     volumes:
   # Add the PVC definition.
     - name: test  # This must match the name in volumeMounts.
       persistentVolumeClaim:
         claimName: test  # Replace this with the name of your PVC.
   ...
   workerGroupSpecs:
     # ... Repeat the preceding volume and volumeMounts configuration for each workerGroupSpec.

4. Apply the changes to the SlurmCluster CR:

   Important

   If the SlurmCluster CR fails to deploy, delete it with kubectl delete slurmcluster slurm-job-demo and redeploy.

   kubectl  apply -f slurmcluster.yaml

   All worker nodes now share the same file system.

Auto scaling

The default Slurm image includes slurm-resume.sh, slurm-suspend.sh, and slurmctld-copilot in the root directory. These scripts interact with slurmctld to manage cluster scaling.

Slurm auto scaling with cloud nodes

• local node: A physical compute node that is directly connected to the cluster manager.

• cloud node: A logical node that represents a VM instance that can be created and terminated on demand by a cloud provider.

Auto scaling in Slurm on ACK