Document approaches for site builds on top of EESSI#778
Open
casparvl wants to merge 27 commits into
Open
Conversation
casparvl
changed the title
ocaisa
requested changes
Jun 9, 2026
casparvl
commented
Jun 10, 2026
first attempt at writing the shared fs section
…, after a reboot, the stratum 0 overlay won't mount
casparvl
marked this pull request as ready for review
June 30, 2026 14:36
…cript. Also, added a full, copyable script combining all the previous components.
Neves-P
self-requested a review
July 7, 2026 08:16
Neves-P
requested changes
Jul 20, 2026
Neves-P
left a comment
Neves-P
left a comment
Member
There was a problem hiding this comment.
Looks really nice! This is my first pass of comments, as of know I only focused on the text. This week I will follow the documentation in practice and review again.
|
|
||
| Another thing to consider is to create a secondary user with `aws iam create-user --user-name <name>` and attach a very limited policy to it (e.g. only read/write/list on buckets, nothing else). Then, create credentials for this user with `aws iam create-access-key --user-name <name>` and provide those credentials to the EESSI build bot and Stratum 0 machines. That way, if that token is compromized, the impact is minimized (e.g. the token can at least not be used to create new IAM idententies, etc). | ||
|
|
||
| ## Setting up the EESSI build bot |
Member
There was a problem hiding this comment.
I'd consider separating this into a new page. The build bot is somewhat self contained and the page is quite long already.
casparvl
commented
Jul 22, 2026
|
|
||
| Another thing to consider is to create a secondary user with `aws iam create-user --user-name <name>` and attach a very limited policy to it (e.g. only read/write/list on buckets, nothing else). Then, create credentials for this user with `aws iam create-access-key --user-name <name>` and provide those credentials to the EESSI build bot and Stratum 0 machines. That way, if that token is compromised, the impact is minimized (e.g. the token can at least not be used to create new IAM idententies, etc). | ||
|
|
||
| ## Setting up the EESSI build bot |
Collaborator
Author
There was a problem hiding this comment.
I realize these docs lack one crucial thing: setting up a site_config_script that sets EESSI_SITE_INSTALL_FORCE and EESSI_SITE_SOFTWARE_PATH_PREFIX
Collaborator
Author
There was a problem hiding this comment.
I.e. at SURF, our site_config_script looks like this:
# To build on top of EESSI, we need to software.eessi.io repository to be mounted next to our own repository
# The bot/build.sh script does this when the EESSI_SITE_INSTALL_FORCE environment variable is set
# Other build scripts will also respect this variable where needed in order to make sure that 'building on top'
# of EESSI is possible
export EESSI_SITE_INSTALL_FORCE=1
echo "Value of EESSI_SITE_INSTALL_FORCE: $EESSI_SITE_INSTALL_FORCE"
# We also need to set a prefix that our installations should end up in
# The build scripts should take this prefix, and construct the final EESSI_SITE_SOFTWARE_PATH out of it
# that the EESSI-extend module expects
export EESSI_SITE_SOFTWARE_PATH_PREFIX=/cvmfs/software.surf.nl/versions/2025.06/
echo "Value of EESSI_SITE_SOFTWARE_PATH_PREFIX: $EESSI_SITE_SOFTWARE_PATH_PREFIX"
One thing to figure out might be how to avoid hard-coding the version in here :)
Collaborator
Author
There was a problem hiding this comment.
Scratch that, this should not be needed anymore... I think we do this differently now... We automatically set these here https://github.com/EESSI/software-layer-scripts/blob/ca929cd7ef32a9fcd79fafd4e0d5c362a1fff452/bot/build.sh#L156 . That happens if the repo_name in the repos config file is unequal to software.eessi.io or dev.eess.io essentially.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.