none
Job Template permission not being applied correctly RRS feed

  • Question

  • Hi,

    We have got HPC Pack 2016 Update 2 with three head nodes for HA, however the job template permissions don't seem to be working correctly, as long as you a valid Cluster user (user role granted for job submission) any job template permissions are being bypassed and user can submit jobs to any template despite its restrictions.

    We tried a number of steps to troubleshoot including stopping inheritance, removing all permissions, or explicitly denying user ability to submit jobs but the behaviour remains as described above.

    Any advice?

    Thursday, February 21, 2019 8:10 AM

All replies

  • Hi MartinTomasson,

    Is the cluster domain joined or not? Is it on premise or in Azure Cloud?

    Which version of HPC Pack are you using? Check it via HPC Cluster Manager -> Help ->  About.

    Regards,

    Yutong Sun

    Friday, February 22, 2019 7:04 AM
  • Hi Yutong,

    Yes it is domain joined, on premise, we're using HPC pack 2016 U2 version 5.2.6291.0

    We are able to set permissions for domain users, they just don't seem be applied when targeting a job template.

    Next step for us would be try single head cluster rather than HA with three head nodes?

    Thanks,

    Martin

    Friday, February 22, 2019 8:06 AM
  • Hi MartinTomasson,

    We will check this issue on our benches. Meanwhile, you may try the single head node setup and see if this works fine.

    Regards,

    Yutong Sun

    Monday, February 25, 2019 2:04 AM
  • Hi Yutong,

    Job template permissions seems to be working fine with single head node setup, is that something you will be addressing to fix in HA setup any time soon?

    Many thanks,

    Martin

    Monday, February 25, 2019 8:42 AM
  • Martin,

    Good catch! We indeed do not include the job template ACL permission support for HA or non domain joined head nodes in HPC Pack 2016 Update 2. The validation is currently skipped. The support is still in our road map and may be added in coming releases.

    Btw, suppose your head nodes are domain joined?

    Regards,

    Yutong Sun

    Thursday, February 28, 2019 3:11 AM
  • Thanks Yutong.

    Yes all three head nodes are domain joined.

    We'll build our environment in a single head node cluster instead.

    On a separate note, is there a way to set credentials on a job scheduler to always run jobs as a specified user? For all incoming jobs?

    Thanks,

    Martin

    Thursday, February 28, 2019 8:31 AM
  • Hi Martin,

    Do you mean save a user credential on a job template to run jobs as that user? I suppose there is no such option in job template configuration.

    Regards,

    Yutong Sun

    Tuesday, March 5, 2019 8:32 AM