Add EFS access point support (aws-parallelcluster#2337)

Signed-off-by: Thomas Heinen <t.heinen@reply.de>

Author: thheinen

cli/src/pcluster/config/cluster_config.py

@@ -371,6 +371,7 @@ def __init__(
         deletion_policy: str = None,
         encryption_in_transit: bool = None,
         iam_authorization: bool = None,
+        accesspoint_id: str = None,
     ):
         super().__init__()
         self.mount_dir = Resource.init_param(mount_dir)
@@ -387,6 +388,7 @@ def __init__(
         )
         self.encryption_in_transit = Resource.init_param(encryption_in_transit, default=False)
         self.iam_authorization = Resource.init_param(iam_authorization, default=False)
+        self.accesspoint_id = Resource.init_param(accesspoint_id)
 
     def _register_validators(self, context: ValidatorContext = None):  # noqa: D102 #pylint: disable=unused-argument
         self._register_validator(SharedStorageNameValidator, name=self.name)
@@ -398,6 +400,7 @@ def _register_validators(self, context: ValidatorContext = None):  # noqa: D102
             EfsMountOptionsValidator,
             encryption_in_transit=self.encryption_in_transit,
             iam_authorization=self.iam_authorization,
+            accesspoint_id=self.accesspoint_id,
             name=self.name,
         )
 

cli/src/pcluster/schemas/cluster_schema.py

@@ -321,6 +321,9 @@ class EfsSettingsSchema(BaseSchema):
     deletion_policy = fields.Str(
         validate=validate.OneOf(DELETION_POLICIES), metadata={"update_policy": UpdatePolicy.SUPPORTED}
     )
+    accesspoint_id = fields.Str(
+        validate=validate.Regexp(r"^fsap-[0-9a-z]{17}$"),
+    )
     encryption_in_transit = fields.Bool(metadata={"update_policy": UpdatePolicy.UNSUPPORTED})
     iam_authorization = fields.Bool(metadata={"update_policy": UpdatePolicy.UNSUPPORTED})
 
@@ -331,7 +334,7 @@ def validate_file_system_id_ignored_parameters(self, data, **kwargs):
         messages = []
         if data.get("file_system_id") is not None:
             for key in data:
-                if key is not None and key not in ["encryption_in_transit", "iam_authorization", "file_system_id"]:
+                if key is not None and key not in ["encryption_in_transit", "iam_authorization", "file_system_id", "accesspoint_id"]:
                     messages.append(EFS_MESSAGES["errors"]["ignored_param_with_efs_fs_id"].format(efs_param=key))
             if messages:
                 raise ValidationError(message=messages)

cli/src/pcluster/templates/cluster_stack.py

@@ -1115,6 +1115,7 @@ def _add_efs_storage(self, id: str, shared_efs: SharedEfs):
             shared_efs.encryption_in_transit
         )
         self.shared_storage_attributes[SharedStorageType.EFS]["IamAuthorizations"].append(shared_efs.iam_authorization)
+        self.shared_storage_attributes[SharedStorageType.EFS]["AccesspointIds"].append(shared_efs.accesspoint_id)
 
         return efs_id
 
@@ -1294,6 +1295,10 @@ def _add_head_node(self):
                     "efs_iam_authorizations": to_comma_separated_string(
                         self.shared_storage_attributes[SharedStorageType.EFS]["IamAuthorizations"], use_lower_case=True
                     ),
+                    "efs_accesspoint_ids": to_comma_separated_string(
+                        self.shared_storage_attributes[SharedStorageType.EFS]["AccesspointIds"],
+                        use_lower_case=True,
+                    ),
                     "fsx_fs_ids": get_shared_storage_ids_by_type(self.shared_storage_infos, SharedStorageType.FSX),
                     "fsx_mount_names": to_comma_separated_string(
                         self.shared_storage_attributes[SharedStorageType.FSX]["MountNames"]

cli/src/pcluster/templates/login_nodes_stack.py

@@ -237,6 +237,10 @@ def _add_login_nodes_pool_launch_template(self):
                         self._shared_storage_attributes[SharedStorageType.EFS]["IamAuthorizations"],
                         use_lower_case=True,
                     ),
+                    "efs_accesspoint_ids": to_comma_separated_string(
+                        self._shared_storage_attributes[SharedStorageType.EFS]["AccesspointIds"],
+                        use_lower_case=True,
+                    ),
                     "enable_intel_hpc_platform": "true" if self._config.is_intel_hpc_platform_enabled else "false",
                     "ephemeral_dir": DEFAULT_EPHEMERAL_DIR,
                     "fsx_fs_ids": get_shared_storage_ids_by_type(self._shared_storage_infos, SharedStorageType.FSX),

cli/src/pcluster/templates/queues_stack.py

@@ -335,6 +335,10 @@ def _add_compute_resource_launch_template(
                         self._shared_storage_attributes[SharedStorageType.EFS]["IamAuthorizations"],
                         use_lower_case=True,
                     ),
+                    "efs_accesspoint_ids": to_comma_separated_string(
+                        self._shared_storage_attributes[SharedStorageType.EFS]["AccesspointIds"],
+                        use_lower_case=True,
+                    ),
                     "fsx_fs_ids": get_shared_storage_ids_by_type(self._shared_storage_infos, SharedStorageType.FSX),
                     "fsx_mount_names": to_comma_separated_string(
                         self._shared_storage_attributes[SharedStorageType.FSX]["MountNames"]

cli/src/pcluster/validators/efs_validators.py

@@ -18,7 +18,7 @@ class EfsMountOptionsValidator(Validator):
     IAM Authorization requires Encryption in Transit.
     """
 
-    def _validate(self, encryption_in_transit: bool, iam_authorization: bool, name: str):
+    def _validate(self, encryption_in_transit: bool, iam_authorization: bool, accesspoint_id: str, name: str):
         if iam_authorization and not encryption_in_transit:
             self._add_failure(
                 "EFS IAM authorization cannot be enabled when encryption in-transit is disabled. "

cli/src/pcluster3_config_converter/pcluster3_config_converter.py

@@ -296,6 +296,7 @@ def convert_efs_settings(self, section_name):
                 ("efs_kms_key_id", "KmsKeyId"),
                 ("provisioned_throughput", "ProvisionedThroughput", "getint"),
                 ("throughput_mode", "ThroughputMode"),
+                ("accesspoint_id", "AccesspointId"),
             ]
             efs_section, efs_dict, _section_label = self.convert_storage_base(
                 "efs", efs_label.strip(), additional_items