add ssh nonroot

ddn-provisioning/nonrootuser.yaml

@@ -0,0 +1,110 @@
+# ------------------------------
+# 1. StorageClass (EXA Storage)
+# ------------------------------
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: exa-sc-1010
+provisioner: exa.csi.ddn.com
+parameters:
+  exaMountUid: "1010"
+---
+# ------------------------------
+# 2. PVC
+# ------------------------------
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: exa-pvc-1010
+  namespace: org2
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: exa-sc-1010
+  resources:
+    requests:
+      storage: 1Gi
+---
+# ------------------------------
+# 3. Pod with internal ssh-keygen
+# ------------------------------
+apiVersion: v1
+kind: Pod
+metadata:
+  name: exa-user-1010-pod
+  namespace: org2
+  labels:
+    app: exa-user
+spec:
+  securityContext:
+    runAsUser: 0
+    runAsGroup: 0
+  volumes:
+    - name: shared-home
+      emptyDir: {}
+    - name: exa-volume
+      persistentVolumeClaim:
+        claimName: exa-pvc-1010
+  containers:
+    - name: app
+      image: ubuntu:22.04
+      ports:
+        - containerPort: 22
+      securityContext:
+        runAsUser: 0
+      command: ["/bin/bash", "-c"]
+      args:
+        - |
+          echo "[INFO] Waiting for network...";
+          for i in {1..30}; do
+            if ping -c 1 8.8.8.8 >/dev/null 2>&1 && nslookup archive.ubuntu.com >/dev/null 2>&1; then
+              echo "[INFO] Network is ready.";
+              break;
+            else
+              echo "[WARN] Network not ready, retrying ($i)...";
+              sleep 2;
+            fi
+          done
+
+          apt update && apt install -y sudo openssh-server openssh-client;
+
+          useradd -m -u 1010 -s /bin/bash appuser;
+          echo "appuser ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers;
+
+          mkdir -p /home/appuser/.ssh;
+          ssh-keygen -t rsa -b 4096 -f /home/appuser/.ssh/id_rsa -N "";
+          cat /home/appuser/.ssh/id_rsa.pub > /home/appuser/.ssh/authorized_keys;
+
+          chown -R 1010:1010 /home/appuser/.ssh;
+          chmod 700 /home/appuser/.ssh;
+          chmod 600 /home/appuser/.ssh/authorized_keys;
+          chmod 600 /home/appuser/.ssh/id_rsa;
+
+          echo "====== PRIVATE KEY ======";
+          cat /home/appuser/.ssh/id_rsa;
+          echo "=========================";
+
+          /usr/sbin/sshd -D
+      volumeMounts:
+        - name: shared-home
+          mountPath: /mnt/home
+        - name: exa-volume
+          mountPath: /data
+
+---
+# ------------------------------
+# 4. SSH Service (port 2222 → 22)
+# ------------------------------
+apiVersion: v1
+kind: Service
+metadata:
+  name: exa-user-ssh-svc
+  namespace: org2
+spec:
+  selector:
+    app: exa-user
+  ports:
+    - protocol: TCP
+      port: 2222
+      targetPort: 22
+

ddn-provisioning/ssh.pem

@@ -0,0 +1,50 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAACFwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAgEA3JPmxzdD8sRAryXnhxUKCiWMCzggasiNCg9rb55fZLSzsn3dtXgR
+Urhgk7rBZJVeF7tJ9Vu//t/MeylETN56Dqz63MvxnSlOmFSfrfpHOPBIb+uCTyPreGYffo
+mMhf/ozQ7yGC4DCBAi9/iADb1bNiCLddIOlGqFwTb0CDidKJ3fW6DDVS2jr0VPAQ3yoguh
+smDwmgXb/ci+aO4rLcMuKj9R/X9lPq0OeQyypytZr+9dsXOhDksJFOoD2x37rkwDQaLjLa
+jzXcM03O31K1vFCpvcgPi6w3C3QaPraWZRpaSRDL+ZhFy7sQwEDVruvM9vHBeh2j4pHJS8
+/xWM/oPkto523Qz2llLALipmFFzjC9luZe+xVxwt59ymDC+XFsWSMbjxgWDubW/v1mzmqp
+zjJRSVmQaeoNBF1Niqc3Vf66t23XwN106jMPGSiyUmsfwtluNsjKx3kIB1LqxZygEZb2S7
+aYbRm2MEsVamqdKbaDQmX6W3OClqwCI3ZmMa+reB4rXNoUG4sdmI0GQiBPhdFkgVeqlolZ
+fFKFm7xkv3airbRBvJ0HL7/LGYQw/1qKjpCdGxbbnSMkAqyE6q5ai/P2rpaQBCazx3b44Q
+6BrbINs+dW0MoDcF0F4TZNt/n+u6Sa8d0rxKZ6BohangFrejtaNOQz5gdMOHsXdNv+lQX6
+UAAAdQywzPlssMz5YAAAAHc3NoLXJzYQAAAgEA3JPmxzdD8sRAryXnhxUKCiWMCzggasiN
+Cg9rb55fZLSzsn3dtXgRUrhgk7rBZJVeF7tJ9Vu//t/MeylETN56Dqz63MvxnSlOmFSfrf
+pHOPBIb+uCTyPreGYffomMhf/ozQ7yGC4DCBAi9/iADb1bNiCLddIOlGqFwTb0CDidKJ3f
+W6DDVS2jr0VPAQ3yoguhsmDwmgXb/ci+aO4rLcMuKj9R/X9lPq0OeQyypytZr+9dsXOhDk
+sJFOoD2x37rkwDQaLjLajzXcM03O31K1vFCpvcgPi6w3C3QaPraWZRpaSRDL+ZhFy7sQwE
+DVruvM9vHBeh2j4pHJS8/xWM/oPkto523Qz2llLALipmFFzjC9luZe+xVxwt59ymDC+XFs
+WSMbjxgWDubW/v1mzmqpzjJRSVmQaeoNBF1Niqc3Vf66t23XwN106jMPGSiyUmsfwtluNs
+jKx3kIB1LqxZygEZb2S7aYbRm2MEsVamqdKbaDQmX6W3OClqwCI3ZmMa+reB4rXNoUG4sd
+mI0GQiBPhdFkgVeqlolZfFKFm7xkv3airbRBvJ0HL7/LGYQw/1qKjpCdGxbbnSMkAqyE6q
+5ai/P2rpaQBCazx3b44Q6BrbINs+dW0MoDcF0F4TZNt/n+u6Sa8d0rxKZ6BohangFrejta
+NOQz5gdMOHsXdNv+lQX6UAAAADAQABAAACAATylFSXmsCRQlorYXwYLrd3jCKcSa3bfb5i
+BijkxoL9wqIYTKbLYKgYVqI5qCjXaNrjao9EVZQj9PQ2Qr/upZI6sw3MzUiXKpokG8jNOl
+e+nAFWqP+ZcKissbwm3a4LxW8EDM4aChteMUqamlS0kJ0wMbCc25LcqM9iqiqdCnlkwSPP
+AVKhyXAe/9yoMW8ND71uizcJNpwEqrCz1ugZ3qk37mDfQKgdPZvdewxg3owhtFpMm6o0aK
+m9bgS2MXUBY3lPbAUUKxFJVaA2/i7QyiSoxlNmQNotZw7j3F3q2535iP9eNNVRNyyLdnPO
+PFij1nws04aPqmBnva2DEDyNPM4IzvXEGSG+TNXri7Xwe9b9Ks5lYmzerqWpl6PYELEwv2
+3bBemuHxqRGUxJd2p+TlL4CXqhFAJWTtU1SGZ1EQDwnSbBln0/sgyKNmegy8L8b9z7kFbB
+bIhsqoPuY4ghEP2zEv6xc00l5c3FIuIJapnkp7kf/FEJIJxQXVe67cCV6NAA5lKA2h7Az3
++DWT7+CG/98eBrgahSoZ1vc7UJ8nBmvQ7uRfyyp7ke0Clw+h4T/Uj23XRLIZjuwVol0RCc
+cn5gri0rM8I5Lzrl8My5DFgt1oxBS+Tgxnz9m/gqD56XhPBpxgMWC0vbtDvy0slvxT4yqy
++72A11zHrFEG4sVQfpAAABAEclQoP8UzteGscMB3tJv72eJdNN4kb35CGhFlov7meUArAw
+mtmZEYKsvycmWnT+9jfozBqIjLwsiW1LRlKO9KqMaHSK0E5vpe28eZnztSG7UYT0V3kgtg
+BFNpKkfGFuwTF5Sei/mu3hkGjfKMejNMK+wl4z2rWaBh3KeKrYV9PRrwbhgmntjiTKaSs6
+gDyqBiVJ4VTCTkHx4Th2anF5AtxiZ5FcBFKo5EoZmr7vLttK+gFlkmEnalZJBIgeSxedCp
+AEK8NseA079g6dtu7xTQeQMIT3c5C1H+ItuSWREN/HRdF6e7+L2Sg7XUOcSHB6xyjnw4sY
+X4Cs1qmoEEStCbkAAAEBAO7NnWapN0VCeyuqCK79H/AHX7Awsviu4rqtHrPqE8v4uOw+uL
+6d6Nws4sOodi063YAUIZaE2L72R6xGy/9mwaQjPwF2QsOFONZp7vrxPUEoGDoAu0z4tHls
+z4qKRnY1S1a10xJutFGqnXk5b8uLTRr2lKp1eYlj03lRz91YW0m1hq89oirlJXH1RyLx2O
+N2fIVU/Jm3Id/pTxJwPx49MalvD2rjtWlDhCdEGaa9ShaCa8vWMwhy2GWSSNrlNRQB8kSx
+5qyZmSzN53NtSNdh1Hfr7FH1x8v+KmGEFVd+MReDpLyPr54SWnofkctqu6t1OvYMRf1Zj+
+X8ipeWeSMMyA8AAAEBAOx2TAENT9OSjw3GlZJrwqMU5t4vGEcbWK7OiIcTio+bzg3e5TBI
+vEURxj/CkMit+osGDXU2ysx99aSe6QizgNJehqpwxfhBzZFqd2JkKoIZzBWDGSn7Oo5bgt
+l1NtAB9hFiRp3VvLb6AT3KtwPRLxS5wfn1/F706QHF4FCPgeHjA5uT7oO8R/nReiFcWMod
+oKkAKuzZiUMweU90irjKLoxQZkQR0nrYNIdRreoq80buSbVTigDNwDFFyy2NigE3aSg1yz
+rEyNdVOpPmYUrzVnT1hf+MMR4qhOGS1UHdyu4RvIH7AVK+3Dajkik29v0WGo/CcQ7otpFG
+yULFsIZQyQsAAAAWcm9vdEBleGEtdXNlci0xMDEwLXBvZAECAwQF
+-----END OPENSSH PRIVATE KEY-----
+

gpulive/jupyter_kustomize/base/tf.yaml

@@ -16,18 +16,18 @@ kind: Deployment
 metadata:
   name: tf-notebook
   labels:
-    workload-name: customer7
+    workload-name: customer3
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: tf-notebook
-      workload-name: customer7
+      workload-name: customer3
   template:
     metadata:
       labels:
         app: tf-notebook
-        workload-name: customer7
+        workload-name: customer3
     spec:
       nodeSelector:
         nodegroup: gpu
@@ -38,7 +38,7 @@ spec:
             limits:
               cpu: "4"
               memory: 16Gi
-              nvidia.com/gpu: 2
+              nvidia.com/gpu: 1
           ports:
             - containerPort: 8888
               name: notebook
@@ -56,7 +56,7 @@ metadata:
   name: tf-notebook
   labels:
     app: tf-notebook
-    workload-name: customer7
+    workload-name: customer3
 spec:
   type: ClusterIP
   ports:
@@ -65,4 +65,4 @@ spec:
       targetPort: 8888
   selector:
     app: tf-notebook
-    workload-name: customer7
+    workload-name: customer3