[openmpi] support non-root users run jobs (introducing runAsUser, runAsGroup, supplementalGroups)

[everpeace]

Fixes #793

Changes

• introduce runAsUser, runAsGroup, supplementalGroups parameters.
• If these parameters set, this package will put securityContext to the master/worker pods.
• changed init.sh to support non-root users can spawn sshd servers.
• changed openmpi-controller path from /root to /openmpi-controller so that non-root users can execute the controller
  • this bump version of openmpi-controller docker image.

Note

new openmpi-controller's docker image needs to be published before merging this.

@jiezhang I need your assistance. Could you build and publish jiezhang/openmpi-controller:0.0.3 before this pr is approved 🙇 ??

---

This change is 

[everpeace]

/assign @jiezhang @inc0
/cc @alsrgv @jlewi

[pdmack]

@everpeace, please autoformat_jsonnet.sh.

[jiezhang]

Review status: 0 of 7 files reviewed at latest revision, all discussions resolved, some commit checks failed.

---

components/openmpi-controller/Dockerfile, line 7 at r1 (raw file):

ENV HOME /root

RUN mkdir -p /openmpi-controller

Can you move it to /kubeflow/openmpi/openmpi-controller? Just be consistent with other artifacts (like assets) deployed by this package.

---

kubeflow/openmpi/assets/init.sh, line 61 at r1 (raw file):

cp ${OPENMPI_DIR}/assets/ssh_config ${HOME}/.ssh/config

SSHD_CONFIG=${OPENMPI_DIR}/assets/sshd_config

nit: all constants declared at the top of the file.

---

Comments from Reviewable

[jiezhang]

@everpeace Sorry I'm unable to move the package to kubeflow due to #197. I'll publish new package once this is merged.

[jiezhang]

Review status: 0 of 7 files reviewed at latest revision, 2 unresolved discussions, some commit checks failed.

---

kubeflow/openmpi/assets/init.sh, line 64 at r1 (raw file):

# when this runs by non-root user.
# we have to create ephemeral hostkeys
if [ "$(id -u)" != "0" ]; then

Consider moving this into a helper function.

---

kubeflow/openmpi/prototypes/openmpi.jsonnet, line 28 at r1 (raw file):

// @optionalParam uploadDataFrom string null Local path where data are uploaded from.
// @optionalParam uploadDataTo string null URI where data are uploaded to. Namespace, name, and pod will be appended to the URI. Only S3 bucket is supported at the moment.
// @optionalParam runAsUser string null uid of the first process of containers in master/worker pods.  If not set, this will be default value of your cluster configuration.

nit: one space

---

Comments from Reviewable

[everpeace]

Review status: 0 of 7 files reviewed at latest revision, 4 unresolved discussions.

---

components/openmpi-controller/Dockerfile, line 7 at r1 (raw file):

Previously, jiezhang (Jie Zhang) wrote…

Can you move it to /kubeflow/openmpi/openmpi-controller? Just be consistent with other artifacts (like assets) deployed by this package.

Done.

---

kubeflow/openmpi/assets/init.sh, line 61 at r1 (raw file):

Previously, jiezhang (Jie Zhang) wrote…

nit: all constants declared at the top of the file.

Done.

---

kubeflow/openmpi/assets/init.sh, line 64 at r1 (raw file):

Previously, jiezhang (Jie Zhang) wrote…

Consider moving this into a helper function.

Done.

---

kubeflow/openmpi/prototypes/openmpi.jsonnet, line 28 at r1 (raw file):

Previously, jiezhang (Jie Zhang) wrote…

nit: one space

Done.

---

Comments from Reviewable

[everpeace]

@jiezhang I fixed my pr about your feedback and rebased it. Would you mind reviewing it again?

Sorry I'm unable to move the package to kubeflow due to #197. I'll publish new package once this is merged.

@jiezhang Ok. I understood the situation. I'll wait for it. Thank you in advance.

please autoformat_jsonnet.sh.

@pdmack apologies 🙇 I did it.

[jlewi]

/lgtm
/hold

Putting a hold on this because I think someone more familiar with this should approve.

[jiezhang]

/lgtm

[jiezhang]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jiezhang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• components/openmpi-controller/OWNERS [jiezhang]
• kubeflow/openmpi/OWNERS [jiezhang]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jiezhang]

/hold cancel

[jiezhang]

/test kubeflow-presubmit

[jiezhang]

/retest

[jiezhang]

Review status: 0 of 7 files reviewed at latest revision, 4 unresolved discussions.

---

kubeflow/openmpi/util.libsonnet, line 16 at r2 (raw file):

      [std.splitLimit(keyValue, "=", 1)[0]]: std.splitLimit(keyValue, "=", 1)[1]
      for keyValue in $.toArray(str)
    } else {},

I just realized that resource limits are not set properly when customResources is null. Thanks for fixing this.

---

Comments from Reviewable

[everpeace]

/test kubeflow-presubmit

[everpeace]

Review status: 0 of 7 files reviewed at latest revision, 5 unresolved discussions.

---

kubeflow/openmpi/util.libsonnet, line 16 at r2 (raw file):

Previously, jiezhang (Jie Zhang) wrote…

I just realized that resource limits are not set properly when customResources is null. Thanks for fixing this.

no worry. sorry for fixing this without mentioning...

---

Comments from Reviewable