Skip to content
Closed
2 changes: 1 addition & 1 deletion cmd/root.go
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ var (
logging.Fatal("cmd.Help function failed: %s", err)
}
},
Version: "v1.82.0",
Version: "v1.83.0",
Annotations: annotation,
}
)
Expand Down
2 changes: 1 addition & 1 deletion community/modules/compute/gke-nodeset/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,6 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:gke-nodeset/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:gke-nodeset/v1.83.0"
}
}
2 changes: 1 addition & 1 deletion community/modules/compute/gke-partition/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,6 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:gke-partition/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:gke-partition/v1.83.0"
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,6 @@ terraform {
}

provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:htcondor-execute-point/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:htcondor-execute-point/v1.83.0"
}
}
2 changes: 1 addition & 1 deletion community/modules/compute/mig/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,6 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:mig/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:mig/v1.83.0"
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,6 @@
terraform {
required_version = "= 1.12.2"
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:schedmd-slurm-gcp-v6-nodeset-dynamic/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:schedmd-slurm-gcp-v6-nodeset-dynamic/v1.83.0"
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,6 @@ terraform {
required_version = "= 1.12.2"

provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:schedmd-slurm-gcp-v6-nodeset-tpu/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:schedmd-slurm-gcp-v6-nodeset-tpu/v1.83.0"
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,6 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:schedmd-slurm-gcp-v6-nodeset/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:schedmd-slurm-gcp-v6-nodeset/v1.83.0"
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,6 @@ terraform {
required_version = "= 1.12.2"

provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:schedmd-slurm-gcp-v6-partition/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:schedmd-slurm-gcp-v6-partition/v1.83.0"
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,10 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:slurm-cloudsql-federation/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:slurm-cloudsql-federation/v1.83.0"
}
provider_meta "google-beta" {
module_name = "blueprints/terraform/hpc-toolkit:slurm-cloudsql-federation/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:slurm-cloudsql-federation/v1.83.0"
}

required_version = "= 1.12.2"
Expand Down
2 changes: 1 addition & 1 deletion community/modules/file-system/nfs-server/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:nfs-server/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:nfs-server/v1.83.0"
}

required_version = "= 1.12.2"
Expand Down
4 changes: 2 additions & 2 deletions community/modules/files/fsi-montecarlo-on-batch/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,9 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:fsi-montecarlo-on-batch/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:fsi-montecarlo-on-batch/v1.83.0"
}
provider_meta "google-beta" {
module_name = "blueprints/terraform/hpc-toolkit:fsi-montecarlo-on-batch/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:fsi-montecarlo-on-batch/v1.83.0"
}
}
2 changes: 1 addition & 1 deletion community/modules/internal/slurm-gcp/login/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,6 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:schedmd-slurm-gcp-v6-controller/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:schedmd-slurm-gcp-v6-controller/v1.83.0"
}
}
2 changes: 1 addition & 1 deletion community/modules/project/service-enablement/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:service-enablement/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:service-enablement/v1.83.0"
}

required_version = "= 1.12.2"
Expand Down
4 changes: 2 additions & 2 deletions community/modules/pubsub/bigquery-sub/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,10 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:bigquery-sub/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:bigquery-sub/v1.83.0"
}
provider_meta "google-beta" {
module_name = "blueprints/terraform/hpc-toolkit:bigquery-sub/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:bigquery-sub/v1.83.0"
}
required_version = "= 1.12.2"
}
2 changes: 1 addition & 1 deletion community/modules/pubsub/topic/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,6 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:topic/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:topic/v1.83.0"
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:htcondor-access-point/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:htcondor-access-point/v1.83.0"
}

required_version = "= 1.12.2"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:htcondor-central-manager/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:htcondor-central-manager/v1.83.0"
}

required_version = "= 1.12.2"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:htcondor-pool-secrets/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:htcondor-pool-secrets/v1.83.0"
}

required_version = "= 1.12.2"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,6 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:schedmd-slurm-gcp-v6-controller/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:schedmd-slurm-gcp-v6-controller/v1.83.0"
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,6 @@ terraform {
required_version = "= 1.12.2"

provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:schedmd-slurm-gcp-v6-login/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:schedmd-slurm-gcp-v6-login/v1.83.0"
}
}
2 changes: 1 addition & 1 deletion community/modules/scripts/wait-for-startup/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:wait-for-startup/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:wait-for-startup/v1.83.0"
}

required_version = "= 1.12.2"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@

terraform {
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:windows-startup-script/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:windows-startup-script/v1.83.0"
}

required_version = "= 1.12.2"
Expand Down
2 changes: 1 addition & 1 deletion examples/gke-a3-ultragpu/gke-a3-ultragpu.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -214,7 +214,7 @@ deployment_groups:
# source: modules/network/private-service-access
# use: [gke-a3-ultra-net-0]
# settings:
# prefix_length: 24
# prefix_length: 22

# # Firewall to allow Managed Lustre connection
# - id: lustre_firewall_rule
Expand Down
2 changes: 1 addition & 1 deletion examples/gke-a4/gke-a4.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -229,7 +229,7 @@ deployment_groups:
# source: modules/network/private-service-access
# use: [gke-a4-net-0]
# settings:
# prefix_length: 24
# prefix_length: 22

# # Firewall to allow Managed Lustre connection
# - id: lustre_firewall_rule
Expand Down
2 changes: 1 addition & 1 deletion examples/gke-a4x/gke-a4x.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -232,7 +232,7 @@ deployment_groups:
# source: modules/network/private-service-access
# use: [gke-a4x-net-0]
# settings:
# prefix_length: 24
# prefix_length: 22

# # Firewall to allow Managed Lustre connection
# - id: lustre_firewall_rule
Expand Down
2 changes: 1 addition & 1 deletion examples/gke-managed-lustre.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ deployment_groups:
source: modules/network/private-service-access
use: [network]
settings:
prefix_length: 24
prefix_length: 22

# Firewall to allow Managed Lustre connection
- id: lustre_firewall_rule
Expand Down
2 changes: 1 addition & 1 deletion examples/gke-tpu-7x/gke-tpu-7x-advanced.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -249,7 +249,7 @@ deployment_groups:
# source: modules/network/private-service-access
# use: [gke-tpu-7x-net-0]
# settings:
# prefix_length: 24
# prefix_length: 22

# # Firewall to allow Managed Lustre connection
# - id: lustre_firewall_rule
Expand Down
2 changes: 1 addition & 1 deletion examples/gke-tpu-v6e/gke-tpu-v6e-advanced.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -249,7 +249,7 @@ deployment_groups:
# source: modules/network/private-service-access
# use: [gke-tpu-v6e-net-0]
# settings:
# prefix_length: 24
# prefix_length: 22

# # Firewall to allow Managed Lustre connection
# - id: lustre_firewall_rule
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,25 @@
# See the License for the specific language governing permissions and
# limitations under the License.

# This creates a file named "nvidia+pytorch+21.10-py3.sqsh", which
# This creates a file named "nvidia+pytorch+24.04-py3.sqsh", which
# uses ~18 GB of disk space. This should be run on a filesystem that
# can be seen by all worker nodes
enroot import docker://nvcr.io#nvidia/pytorch:24.04-py3

# Fix for non-interactive shells where XDG_RUNTIME_DIR is not set
if [ -z "$XDG_RUNTIME_DIR" ]; then
# Try creating a user-specific directory in /run (often fails for non-root)
XDG_RUNTIME_DIR="/run/user/$(id -u)"
export XDG_RUNTIME_DIR

# Check if we can actually use it
if [ ! -d "$XDG_RUNTIME_DIR" ]; then
# Fallback to a guaranteed writable location in /tmp
XDG_RUNTIME_DIR="/tmp/enroot-runtime-$(id -u)"
export XDG_RUNTIME_DIR
mkdir -p "$XDG_RUNTIME_DIR"
chmod 700 "$XDG_RUNTIME_DIR"
fi
Comment on lines +27 to +33

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

The script creates a temporary directory in /tmp using a predictable name based on the user's UID, which is insecure and vulnerable to symlink attacks in a multi-user environment. An attacker could pre-create this directory with insecure permissions to intercept or interfere with the enroot import process. Additionally, the script lacks set -e, meaning it will continue to execute even if chmod 700 fails. It is recommended to use mktemp -d for secure and unique directory creation.

Suggested change
if [ ! -d "$XDG_RUNTIME_DIR" ]; then
# Fallback to a guaranteed writable location in /tmp
XDG_RUNTIME_DIR="/tmp/enroot-runtime-$(id -u)"
export XDG_RUNTIME_DIR
mkdir -p "$XDG_RUNTIME_DIR"
chmod 700 "$XDG_RUNTIME_DIR"
fi
if [ ! -d "$XDG_RUNTIME_DIR" ]; then
# Fallback to a guaranteed writable location in /tmp
XDG_RUNTIME_DIR=$(mktemp -d -t enroot-runtime-$(id -u).XXXXXX)
export XDG_RUNTIME_DIR
fi
References
  1. In shell scripts, avoid creating temporary directories in /tmp with predictable names and world-writable permissions, especially with sudo, as this is vulnerable to symlink attacks. Prefer using mktemp -d for secure temporary directory creation, or use mkdir with restrictive permissions (e.g., 700) and without sudo.

fi

# Import the pytorch container
enroot import "docker://nvcr.io#nvidia/pytorch:24.04-py3"
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,22 @@
# This creates a file named "nvidia+pytorch+24.09-py3.sqsh", which
# uses ~18 GB of disk space. This should be run on a filesystem that
# can be seen by all worker nodes
enroot import docker://nvcr.io#nvidia/pytorch:24.09-py3

# Fix for non-interactive shells where XDG_RUNTIME_DIR is not set
if [ -z "$XDG_RUNTIME_DIR" ]; then
# Try creating a user-specific directory in /run (often fails for non-root)
XDG_RUNTIME_DIR="/run/user/$(id -u)"
export XDG_RUNTIME_DIR

# Check if we can actually use it
if [ ! -d "$XDG_RUNTIME_DIR" ]; then
# Fallback to a guaranteed writable location in /tmp
XDG_RUNTIME_DIR="/tmp/enroot-runtime-$(id -u)"
export XDG_RUNTIME_DIR
mkdir -p "$XDG_RUNTIME_DIR"
chmod 700 "$XDG_RUNTIME_DIR"
fi
Comment on lines +27 to +33

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

The script creates a temporary directory in /tmp using a predictable name based on the user's UID, which is insecure and vulnerable to symlink attacks in a multi-user environment. An attacker could pre-create this directory with insecure permissions to intercept or interfere with the enroot import process. Additionally, the script lacks set -e, meaning it will continue to execute even if chmod 700 fails. It is recommended to use mktemp -d for secure and unique directory creation.

Suggested change
if [ ! -d "$XDG_RUNTIME_DIR" ]; then
# Fallback to a guaranteed writable location in /tmp
XDG_RUNTIME_DIR="/tmp/enroot-runtime-$(id -u)"
export XDG_RUNTIME_DIR
mkdir -p "$XDG_RUNTIME_DIR"
chmod 700 "$XDG_RUNTIME_DIR"
fi
if [ ! -d "$XDG_RUNTIME_DIR" ]; then
# Fallback to a guaranteed writable location in /tmp
XDG_RUNTIME_DIR=$(mktemp -d -t enroot-runtime-$(id -u).XXXXXX)
export XDG_RUNTIME_DIR
fi
References
  1. In shell scripts, avoid creating temporary directories in /tmp with predictable names and world-writable permissions, especially with sudo, as this is vulnerable to symlink attacks. Prefer using mktemp -d for secure temporary directory creation, or use mkdir with restrictive permissions (e.g., 700) and without sudo.

fi

# Import the pytorch container
enroot import "docker://nvcr.io#nvidia/pytorch:24.09-py3"
20 changes: 14 additions & 6 deletions examples/ml-slurm-g4.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -73,11 +73,11 @@ deployment_groups:
enable_nvidia_dcgm: false
nvidia_packages:
# 1. Open Kernel Driver: Installs the open-source kernel components.
- nvidia-kernel-open-575
# 2. Driver Metapackage: Pulls in the 580.xx driver version.
- cuda-drivers-575
# 3. CUDA Toolkit: Installs the 12.9.1 toolkit.
- cuda-toolkit-12-9
- nvidia-driver-590-open
# 2. Driver Metapackage: Pulls in the 590.xx driver version.
- cuda-drivers-590
# 3. CUDA Toolkit: Installs the 12.8 toolkit (stable for 590).
- cuda-toolkit-12-8
- datacenter-gpu-manager

tasks:
Expand All @@ -98,10 +98,18 @@ deployment_groups:
ansible.builtin.apt:
update_cache: true

# Install the package
# Latest Ubuntu images pre-install a firmware package that conflicts
# with the NVIDIA repository version.
- name: Remove conflicting Ubuntu NVIDIA firmware
ansible.builtin.apt:
name: nvidia-firmware-590
state: absent

# Install the package with force-overwrite to handle any remaining file conflicts
- name: Install NVIDIA fabric and CUDA
ansible.builtin.apt:
name: "{{ item }}"
dpkg_options: 'force-overwrite'
loop: "{{ nvidia_packages }}"

# This section will optionally freeze the packages with
Expand Down
4 changes: 2 additions & 2 deletions modules/compute/gke-node-pool/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -30,9 +30,9 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:gke-node-pool/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:gke-node-pool/v1.83.0"
}
provider_meta "google-beta" {
module_name = "blueprints/terraform/hpc-toolkit:gke-node-pool/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:gke-node-pool/v1.83.0"
}
}
2 changes: 1 addition & 1 deletion modules/compute/resource-policy/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ terraform {
}

provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:resource-policy/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:resource-policy/v1.83.0"
}

required_version = "= 1.12.2"
Expand Down
4 changes: 2 additions & 2 deletions modules/compute/vm-instance/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -31,10 +31,10 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:vm-instance/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:vm-instance/v1.83.0"
}
provider_meta "google-beta" {
module_name = "blueprints/terraform/hpc-toolkit:vm-instance/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:vm-instance/v1.83.0"
}

required_version = "= 1.12.2"
Expand Down
4 changes: 2 additions & 2 deletions modules/file-system/cloud-storage-bucket/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -30,10 +30,10 @@ terraform {
}
}
provider_meta "google" {
module_name = "blueprints/terraform/hpc-toolkit:cloud-storage-bucket/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:cloud-storage-bucket/v1.83.0"
}
provider_meta "google-beta" {
module_name = "blueprints/terraform/hpc-toolkit:cloud-storage-bucket/v1.82.0"
module_name = "blueprints/terraform/hpc-toolkit:cloud-storage-bucket/v1.83.0"
}
required_version = "= 1.12.2"
}
Loading
Loading