dask / dask/dask-gateway

support running Dask-Gateway on HPC systems without the use of sudo

Open
#335 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
148
Forks
93
PR merge metrics
No merged PRs in 30d

Description

**What happened**:

Currently , the jobqueue component of `dask-gateway` relies on sudo to do user authentication on its own, rather than integrating with authentication mechanisms provided by the respective systems it is deployed on, or just submitting with the user privileges it is given by the admin.

The current implementation is a big *NO* for any production HPC system, and I can't imagine any sysadmin in their right mind who would allow such practice.

**What you expected to happen**:

Run as a user, **never** try to sudo.

**Minimal Complete Verifiable Example**:

Submit a job through the SLURM or PBS backend.

**Anything else we need to know?**:

In a production environment, it is OK if the dask-gateway server runs as a special user, either per-project or globally. However, that implies that all jobs should be submitted as that specific user, rather than trying to impersonate a different user. To still allow tracing back cluster jobs to the users who submitted them, it should be possible to assign individual names to the `GatewayCluster`s submitted to disambiguate them later, e.g. a userid or userid+sessionid.

**Environment**:

- Dask version: 2.25.0
- Python version: 3.7.0
- Operating System: linux ppc64le
- Install method (conda, pip, source): source

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.