search

NOAA-GSL / ExascaleWorkflowSandbox

Other
2 stars 2 forks source link

Migrate S3 Spack build cache to us-east-2 #76

Closed christopherwharrop-noaa closed 6 months ago

christopherwharrop-noaa commented 6 months ago

This PR updates the CI workflow with new AWS role-based authentication for use with a new S3 bucket in the us-east-2 AWS region. It also updates the install scripts used for installation on on-prem HPC platforms to take into account the new mechanism for obtaining SSO AWS credentials. Closes #77.

The CI workflow new uses the configure-aws-credentials github action to assume a role that is authorized to access AWS resources from github. The temporary credentials are configured to last 6 hours, which is the maximum duration of a GitHub Actions CI job. The action supplies the temporary keys and tokens needed for passing into the Docker builds for pushing to the Spack binary build cache on S3. Due to very slow push times to S3, the CI workflow was split into more jobs (which each have a 6 hour time limit) to allow for more time to complete the push step at the end of the spack-stack build. Additionally, a more powerful runner is used to enable more parallelism in the make steps of the spack-stack builds.

No AWS credentials are needed to run the ./install.sh script when installing on on-prem HPC systems. However, if one wishes to populate the S3 binary build cache for a particular HPC system OS, SSO credentials are needed for the push step. In order to set up those credentials, a user will need to run aws configure to create a profile and supply the AWS start URL and a few other things. The user will be prompted to login with SSO credentials. Once that is done, the profile is used to login using aws sso login --profile $PROFILE. After SSO credentials are configured and the user logged in, if the user runs ./insall.sh $PROFILE, it will add the read/write binary build cache as an additional mirror and will attempt to push after the build, populating the binary build cache for future use.

christopherwharrop-noaa commented 6 months ago

@maddenp-noaa - Thank you for looking at this. I know it's not really part of your normal set of tasks. The role for use in GitHub actions was created by top-level admins and was connected by them to a new OIDC provider. The way it is configured, only specific repositories can make use of the role, and only for specific branches. I'm happy to discuss more details offline as I don't want to record that type of information for posterity here.

Thanks again for looking at this.