#
usm-sync-users
●
If the system is running in the default service mode, perform the following set of steps to remove a user:
1. Execute the
ux-tenant-remove-user
command to add the user.
#
ux-tenant-remove-user -u newUser tenantName
2. Verify that the user was removed by executing the
ux-tenant-list-users
command
#
ux-tenant-list-users
3. Execute the
usm-sync-users
command to sync the user.
#
usm-sync-users
By default, users are added to a tenant VM with restricted user access, which prevents them from logging on
to physical nodes, such as login nodes. If required, execute the
ux-tenant-relax
command to allow the
user to log on to login nodes. For more information, refer to
Authentication and Authorization
on page 175,
on page 189 and
Tenant Management CLI Commands
on page 196.
Troubleshooting
The default log file for the
usm-sync-users
and
usm-recreate-secret
commands is located
at
/var/log/usm/urika-secret-manager.log
.
utp-server
logs are located on the host node
under
/var/log/utp/
.
7.5.7
Multi-Tenancy
Urika-GX 2.1 provides secure multi-tenant operation in addition to default mode operation
Although Urika-GX enables users to use a single tenant infrastructure, users can also opt to use multi-tenancy,
which features:
●
File system and data isolation - All relevant file systems are available to tenants, including but not limited to
NFS, Lustre and HDFS. However, a tenant can only access their own data and have no visibility into the
existence of data belonging to other tenants. This includes local file systems used for temporary working
space. In addition, users cannot see the top level directory or path of any other tenant due to separate mount
points for NFS and Lustre. Lustre access is achieved by mounting Lustre directories from the node that is
hosting the tenant VM using NFS across the virtual network shared by the tenant VM and the host node.
There is no direct mount of Lustre available on the tenant VM.
●
Login isolation - Each user logged into a tenant is isolated from other tenants and can only know about
users belonging to the same tenant.
●
Job isolation - Information belonging to Spark jobs running in a given tenant is visible only to the users
belonging to the same tenant. Each job is executed within a container, which is orchestrated via Kubernetes.
●
Secret isolation - Secrets relevant to a given tenant are visible only within that tenant virtual machine
●
Usage accounting - Per tenant usage accounting data for tenant groups is available only to the tenant
admin.
●
Network Isolation - Network traffic is isolated for each tenant using the Romana overlay network on
Kubernetes. It is configured automatically by tenant management commands. No separate actions are
required from admins.
●
Installation of local packages - Local packages can be installed on the tenant VM. However, this is only
supported for applications that run entirely on the tenant VM, and not for applications that run on the cluster.
Security
S3016
202
