Documentation: External Authentication Integration with JWKS and RS256 Tokens

[und-miller]

Would it be possible to get documentation guidance on how to utilize External Authentication Integration with JWKS and RS256 Tokens with Slinky? I do not see any documentation on how to configure Slinky to utilize an external Auth provider.

Specifically, where are the following variables set?

AuthAltTypes=auth/jwt
AuthAltParameters=jwks=/var/spool/slurm/statesave/jwks.json

[vivian-hafener]

Good morning @und-miller,

Those values can be set within helm/slurm/values.yaml here: https://github.com/SlinkyProject/slurm-operator/blob/main/helm/slurm/values.yaml#L218C1-L224C26

controller.extraConfMap gets used to build the slurm.conf file that gets included in the slurm-config ConfigMap here: https://github.com/SlinkyProject/slurm-operator/blob/main/internal/builder/controllerbuilder/controller_config.go#L160. Because of variable precedence used in slurm.conf, variables set later on in slurm.conf override those set earlier on.

Please let me know if you have any further questions.

Best regards,
Vivian Hafener

[und-miller]

Thank you for the reply.

@vivian-hafener how is the jwks.json key mounted in the pod?

[vivian-hafener]

For JWTs generated automatically by Slurm-Operator, we perform a secret projection here: https://github.com/SlinkyProject/slurm-operator/blob/main/internal/builder/controllerbuilder/controller_app.go#L174C7-L193C9

If you intend to use external authentication, how you mount that file into the pod is up to you. I would recommend that you do the same as we do - putting the contents of the jwks.json in a Secret, and mounting that as a volume into a pod: https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod. You can specify additional volume mounts for the Slinky pods under the podSpec field of each CRD in helm/slurm/values.yaml.

Best,
Vivian Hafener

[und-miller]

I deployed the new helm values and secret as you suggested. However, I am not seeing the /var/spool/slurm/statesave/ directory or the jwks.json file in the slurm controller pod. See my values config below.

What am I missing?

slurm:
  controller:
    podSpec:
      containers:
      - name: slurm-controller
        volumeMounts:
        - name: slurm-jwks
          mountPath: /var/spool/slurm/statesave/jwks.json
          subPath: jwks.json
      volumes:
      - name: slurm-jwks
        secret:
          secretName: slurm-jwks
          optional: false

[vivian-hafener]

I am not seeing the /var/spool/slurm/statesave/ directory or the jwks.json file in the slurm controller pod.

Note that the path of the slurmctld state save directory is /var/spool/slurmctld/statesave by default for all Slinky deployments. That directory is either backed by a PVC or an EmptyDir depending on whether you deployed with controller.persistence.enabled == true. Given this behavior, I would advise that you locate the jwks.json file outside of this directory to ensure that your secret projection is fully deconflicted from the management of this volume.

[und-miller]

I have tried other directories and get the same behavior.

[vivian-hafener]

Could you send me the output of:

kubectl describe secret -n slurm slurm-jwks 

[und-miller]

We are using different namespace, but the command is the same.

kubectl describe secret -n und-slinky slurm-jwks 
Name:         slurm-jwks
Namespace:   und-slinky
Labels:       <none>
Annotations:  <none>

Type:  Opaque

Data
====
jwks.json:  3036 bytes

[vivian-hafener]

Good morning @und-miller,

I will look into this and get back to you.

Best,
Vivian Hafener

[vivian-hafener]

Good afternoon @und-miller,

Development work is needed in order for JWKS to function properly in Slurm-operator. I have begun this work and will update this ticket once those changes are merged into main.

Best,
Vivian Hafener