entrypoints: dereference symlinks when copying sssd config (cp -rL)

The sssd config now arrives as a k8s Secret volume, where files are
symlinks into the ..data directory. cp -r copied the symlink itself,
leaving /etc/sssd/sssd.conf dangling and sssd starting with no domains.
cp -rL copies the file content. (The munge key copy is unaffected: plain
cp already dereferences its source.)

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: rahimkhoja

slurmctld/entrypoint.sh

@@ -64,12 +64,13 @@ fi
 # =============================================================================
 # SSSD SETUP - Standardized across Slurm services that require it
 # =============================================================================
-# The real sssd.conf is mounted read-only at /etc/sssd/.secret/ and copied
+# The real sssd.conf is mounted read-only at /etc/sssd/.secret/ (a k8s Secret)
+# and copied with -L to dereference the secret volume symlinks, because sssd
 # into place because sssd requires 0600 root-owned config, which a k8s
 # volume mount cannot guarantee by itself.
 
 if [ -f /etc/sssd/.secret/sssd.conf ]; then
-    cp -r /etc/sssd/.secret/* /etc/sssd
+    cp -rL /etc/sssd/.secret/* /etc/sssd
     chmod 700 /etc/sssd
     chmod 600 /etc/sssd/sssd.conf
     chown root:root /etc/sssd /etc/sssd/sssd.conf

slurmrestd/entrypoint.sh

@@ -38,7 +38,7 @@ mkdir -p /var/log/slurm /var/run/slurm
 # does run sssd). If the mount is added later this block picks it up.
 
 if [ -f /etc/sssd/.secret/sssd.conf ]; then
-    cp -r /etc/sssd/.secret/* /etc/sssd
+    cp -rL /etc/sssd/.secret/* /etc/sssd
     chmod 700 /etc/sssd
     chmod 600 /etc/sssd/sssd.conf
     chown root:root /etc/sssd /etc/sssd/sssd.conf