This document explains how to establish an SSH connection to your cluster's nodes in Cluster Director. Based on your cluster's orchestrator, connecting to a node lets you perform the following tasks:
Slurm clusters: manage shared file systems, submit Slurm jobs to the cluster scheduler, inspect logs, or manually run a health check on a GPU.
Managed compute clusters: connect to compute instances to configure your environment and launch distributed workloads.
For more information on how Compute Engine uses key-based SSH authentication to establish connections to a Compute Engine instance, see About SSH connections.
Before you begin
Before you connect to a login or compute node in a cluster, consider the following:
When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication.
If you encounter errors when connecting to your node, then see Troubleshooting SSH errors.
Required roles
To get the permissions that you need to connect to a login or compute node in a cluster, ask your administrator to grant you the following IAM roles:
-
To view clusters:
Cluster Director Editor (
roles/hypercomputecluster.editor) on your project -
To connect to a node:
- Compute OS Login (
roles/compute.osLogin) on your project - Service Account User (
roles/iam.serviceAccountUser) on the Compute Engine default service account
- Compute OS Login (
-
To connect to a node secured by Identity-Aware Proxy (IAP):
IAP-Secured Tunnel User (
roles/iap.tunnelResourceAccessor) on your project
For more information about granting roles, see Manage access to projects, folders, and organizations.
These predefined roles contain the permissions required to connect to a login or compute node in a cluster. To see the exact permissions that are required, expand the Required permissions section:
Required permissions
The following permissions are required to connect to a login or compute node in a cluster:
-
To view a list of clusters:
hypercomputecluster.clusters.list -
To view the details of a single cluster:
hypercomputecluster.clusters.get -
To connect to a node:
-
compute.instances.osLogin -
iam.serviceAccounts.actAs
-
-
To connect to a node secured by IAP:
iap.tunnelInstances.accessViaIAP
You might also be able to get these permissions with custom roles or other predefined roles.
Connect to a cluster
The following sections explain how to connect to a login node in a Slurm cluster, or a compute node in a Slurm cluster or a managed compute cluster.
Connect to a cluster's login node
To connect to a cluster's login node in a Slurm cluster by using SSH, complete the following steps:
In the Google Cloud console, go to the Clusters page.
In the Clusters table, in the Name column, click the name of the cluster that you want to connect to. A page that gives the details of the cluster appears, and the Details tab is selected.
Click the Nodes tab.
In the Login nodes section, in the Connect column, click the SSH button in the row that contains your login node. The SSH-in-browser window opens.
If prompted, then click Authorize. Connecting to your node can take up to a minute to complete.
Connect to a cluster's compute node
To connect to a compute node in a Slurm cluster or a managed compute cluster by using SSH, complete the following steps. To run a command across all compute nodes in a managed instance group (MIG), see Run a command across compute nodes in a MIG.
In the Google Cloud console, go to the Clusters page.
In the Clusters table, in the Name column, click the name of the cluster that you want to connect to. A page that gives the details of the cluster appears, and the Details tab is selected.
Click the Nodes tab.
In the Compute nodes section, click SSH in the row for the compute node that you want to connect to (or click the node name and then click SSH).
If prompted, then click Authorize. Connecting to your node can take up to a minute to complete.