From 47dcdbb1f1540f85701cbd7e9902e03b213697a8 Mon Sep 17 00:00:00 2001
From: Sarthak Agrawal <sagrawal@together.ai>
Date: Wed, 20 May 2026 17:19:00 -0700
Subject: [PATCH] fix: TCL-6370 revert login pod to configless-only

The login pod was statically mounting slurm.conf at /etc/slurm/ via the
slurm-config ConfigMap, with an initContainer chmod'ing files for mixed
permissions. This intercepted srun's config lookup at /etc/slurm/slurm.conf
and prevented the configless fallback to /run/slurm/conf/slurm.conf.

The static mount also did not include plugstack.conf (which lives in the
separate slurm-config-extra ConfigMap), so srun could not find SPANK plugin
config -> Pyxis did not load -> --container-image options failed silently.

Revert to upstream Slinky's fully-configless login pod design:
- /etc/slurm/ contains only slurm.key (the sackd auth key).
- sackd fetches slurm.conf, plugstack.conf, etc. via --conf-server into
  /run/slurm/conf/ at default Slurm mode 0644.
- srun's lookup falls through /etc/slurm/slurm.conf (missing) to
  /run/slurm/conf/slurm.conf, which is readable by LDAP users and has
  plugstack.conf in the same dir -> Pyxis loads automatically.

This also eliminates the original LDAP permission problem that the
initContainer chmod dance was solving, because the problematic
mixed-permission static mount no longer exists.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../templates/login/login-deployment.yaml      | 18 +-----------------
 1 file changed, 1 insertion(+), 17 deletions(-)

diff --git a/helm/slurm/templates/login/login-deployment.yaml b/helm/slurm/templates/login/login-deployment.yaml
index 5addbb1c..29301262 100644
--- a/helm/slurm/templates/login/login-deployment.yaml
+++ b/helm/slurm/templates/login/login-deployment.yaml
@@ -51,16 +51,6 @@ spec:
           labelSelector:
             matchLabels:
               {{- include "slurm.login.selectorLabels" . | nindent 12 }}
-      initContainers:
-      - name: fix-perms
-        image: "{{ .Values.login.image.repository }}:{{ .Values.login.image.tag }}"
-        command: ["sh", "-c", "set -e && cp /mnt/slurm/* /etc/slurm/ && chmod 644 /etc/slurm/*.conf && chmod 600 /etc/slurm/*.key && chown -R root:root /etc/slurm/"]
-        volumeMounts:
-        - name: slurm-config-projected
-          mountPath: /mnt/slurm
-          readOnly: true
-        - name: slurm-config
-          mountPath: /etc/slurm
       containers:
       - name: login
         image: "{{ .Values.login.image.repository }}:{{ .Values.login.image.tag }}"
@@ -103,18 +93,12 @@ spec:
           {{- end }}
         {{- end }}
       volumes:
-      - name: slurm-config
-        emptyDir: {}
-      - name: slurm-config-projected  # TCL-4402: projected volume, copied by initContainer with split permissions
+      - name: slurm-config 
         projected:
           defaultMode: 0600
           sources:
-          - configMap:
-              name: {{ include "slurm.fullname" . }}-config
           - secret:
               name: {{ include "slurm.fullname" . }}-auth-slurm
-          - secret:
-              name: {{ include "slurm.fullname" . }}-auth-jwths256
       {{- if .Values.login.sharedMemorySize }}
       - name: dshm
         emptyDir: