Thheinen/efs accesspoints

CHANGELOG.md

@@ -10,6 +10,7 @@ CHANGELOG
 - Add support for ap-southeast-3 region.
 - Add security groups to login node network load balancer.
 - Add `AllowedIps` configuration for login nodes.
+- Add new configuration `SharedStorage/EfsSettings/AccessPointId` to specify an optional EFS access point for a mount
 
 **BUG FIXES**
 - Fix validator `EfaPlacementGroupValidator` so that it does not suggest to configure a Placement Group when Capacity Blocks are used.

cli/src/pcluster/aws/efs.py

@@ -80,3 +80,14 @@ def describe_file_system(self, efs_fs_id):
         :return: the mount_target_ids
         """
         return self._client.describe_file_systems(FileSystemId=efs_fs_id)
+
+    @AWSExceptionHandler.handle_client_exception
+    @Cache.cached
+    def describe_access_point(self, access_point_id):
+        """
+        Describe access point attributes for the given EFS access point id.
+
+        :param efaccess_point_ids_ap_id: EFS access point Id
+        :return: the access_point details
+        """
+        return self._client.describe_access_points(AccessPointId=access_point_id)

cli/src/pcluster/config/cluster_config.py

@@ -149,7 +149,7 @@
     PlacementGroupCapacityTypeValidator,
     PlacementGroupNamingValidator,
 )
-from pcluster.validators.efs_validators import EfsMountOptionsValidator
+from pcluster.validators.efs_validators import EfsMountOptionsValidator, EfsAccessPointOptionsValidator
 from pcluster.validators.feature_validators import FeatureRegionValidator
 from pcluster.validators.fsx_validators import (
     FsxAutoImportValidator,
@@ -371,6 +371,7 @@ def __init__(
         deletion_policy: str = None,
         encryption_in_transit: bool = None,
         iam_authorization: bool = None,
+        access_point_id: str = None,
     ):
         super().__init__()
         self.mount_dir = Resource.init_param(mount_dir)
@@ -387,6 +388,7 @@ def __init__(
         )
         self.encryption_in_transit = Resource.init_param(encryption_in_transit, default=False)
         self.iam_authorization = Resource.init_param(iam_authorization, default=False)
+        self.access_point_id = Resource.init_param(access_point_id)
 
     def _register_validators(self, context: ValidatorContext = None):  # noqa: D102 #pylint: disable=unused-argument
         self._register_validator(SharedStorageNameValidator, name=self.name)
@@ -400,7 +402,12 @@ def _register_validators(self, context: ValidatorContext = None):  # noqa: D102
             iam_authorization=self.iam_authorization,
             name=self.name,
         )
-
+        self._register_validator(
+            EfsAccessPointOptionsValidator,
+            access_point_id=self.access_point_id,
+            file_system_id=self.file_system_id,
+            encryption_in_transit=self.encryption_in_transit
+        )
 
 class BaseSharedFsx(Resource):
     """Represent the shared FSX resource."""

cli/src/pcluster/schemas/cluster_schema.py

@@ -321,6 +321,9 @@ class EfsSettingsSchema(BaseSchema):
     deletion_policy = fields.Str(
         validate=validate.OneOf(DELETION_POLICIES), metadata={"update_policy": UpdatePolicy.SUPPORTED}
     )
+    access_point_id = fields.Str(
+        validate=validate.Regexp(r"^fsap-[0-9a-z]{17}$"), metadata={"update_policy": UpdatePolicy.UNSUPPORTED}
+    )
     encryption_in_transit = fields.Bool(metadata={"update_policy": UpdatePolicy.UNSUPPORTED})
     iam_authorization = fields.Bool(metadata={"update_policy": UpdatePolicy.UNSUPPORTED})
 
@@ -331,7 +334,12 @@ def validate_file_system_id_ignored_parameters(self, data, **kwargs):
         messages = []
         if data.get("file_system_id") is not None:
             for key in data:
-                if key is not None and key not in ["encryption_in_transit", "iam_authorization", "file_system_id"]:
+                if key is not None and key not in [
+                    "encryption_in_transit",
+                    "iam_authorization",
+                    "file_system_id",
+                    "access_point_id"
+                ]:
                     messages.append(EFS_MESSAGES["errors"]["ignored_param_with_efs_fs_id"].format(efs_param=key))
             if messages:
                 raise ValidationError(message=messages)

cli/src/pcluster/templates/cluster_stack.py

@@ -1115,6 +1115,7 @@ def _add_efs_storage(self, id: str, shared_efs: SharedEfs):
             shared_efs.encryption_in_transit
         )
         self.shared_storage_attributes[SharedStorageType.EFS]["IamAuthorizations"].append(shared_efs.iam_authorization)
+        self.shared_storage_attributes[SharedStorageType.EFS]["AccessPointIds"].append(shared_efs.access_point_id)
 
         return efs_id
 
@@ -1294,6 +1295,10 @@ def _add_head_node(self):
                     "efs_iam_authorizations": to_comma_separated_string(
                         self.shared_storage_attributes[SharedStorageType.EFS]["IamAuthorizations"], use_lower_case=True
                     ),
+                    "efs_access_point_ids": to_comma_separated_string(
+                        self.shared_storage_attributes[SharedStorageType.EFS]["AccessPointIds"],
+                        use_lower_case=True,
+                    ),
                     "fsx_fs_ids": get_shared_storage_ids_by_type(self.shared_storage_infos, SharedStorageType.FSX),
                     "fsx_mount_names": to_comma_separated_string(
                         self.shared_storage_attributes[SharedStorageType.FSX]["MountNames"]

cli/src/pcluster/templates/login_nodes_stack.py

@@ -237,6 +237,10 @@ def _add_login_nodes_pool_launch_template(self):
                         self._shared_storage_attributes[SharedStorageType.EFS]["IamAuthorizations"],
                         use_lower_case=True,
                     ),
+                    "efs_access_point_ids": to_comma_separated_string(
+                        self._shared_storage_attributes[SharedStorageType.EFS]["AccessPointIds"],
+                        use_lower_case=True,
+                    ),
                     "enable_intel_hpc_platform": "true" if self._config.is_intel_hpc_platform_enabled else "false",
                     "ephemeral_dir": DEFAULT_EPHEMERAL_DIR,
                     "fsx_fs_ids": get_shared_storage_ids_by_type(self._shared_storage_infos, SharedStorageType.FSX),

cli/src/pcluster/templates/queues_stack.py

@@ -335,6 +335,10 @@ def _add_compute_resource_launch_template(
                         self._shared_storage_attributes[SharedStorageType.EFS]["IamAuthorizations"],
                         use_lower_case=True,
                     ),
+                    "efs_access_point_ids": to_comma_separated_string(
+                        self._shared_storage_attributes[SharedStorageType.EFS]["AccessPointIds"],
+                        use_lower_case=True,
+                    ),
                     "fsx_fs_ids": get_shared_storage_ids_by_type(self._shared_storage_infos, SharedStorageType.FSX),
                     "fsx_mount_names": to_comma_separated_string(
                         self._shared_storage_attributes[SharedStorageType.FSX]["MountNames"]

cli/src/pcluster/validators/efs_validators.py

@@ -25,3 +25,26 @@ def _validate(self, encryption_in_transit: bool, iam_authorization: bool, name:
                 f"Please either disable IAM authorization or enable encryption in-transit for file system {name}",
                 FailureLevel.ERROR,
             )
+
+class EfsAccessPointOptionsValidator(Validator):
+    """
+    EFS Mount Options validator.
+
+    IAM Authorization requires Encryption in Transit.
+    """
+
+    def _validate(self,  access_point_id: str, file_system_id: str, encryption_in_transit: bool):
+
+        if access_point_id and not file_system_id:
+            self._add_failure(
+                "An access point can only be specified when using an existing EFS file system. "
+                f"Please either remove the access point id {access_point_id} or provide the file system id for the access point",
+                FailureLevel.ERROR,
+            )
+
+        if access_point_id and not encryption_in_transit:
+            self._add_failure(
+                "An access point can only be specified when encryption in transit is enabled. "
+                f"Please either remove the access point id {access_point_id} or enable encryption in transit.",
+                FailureLevel.ERROR,
+            )

cli/src/pcluster3_config_converter/pcluster3_config_converter.py

@@ -296,6 +296,7 @@ def convert_efs_settings(self, section_name):
                 ("efs_kms_key_id", "KmsKeyId"),
                 ("provisioned_throughput", "ProvisionedThroughput", "getint"),
                 ("throughput_mode", "ThroughputMode"),
+                ("access_point_id", "AccessPointId"),
             ]
             efs_section, efs_dict, _section_label = self.convert_storage_base(
                 "efs", efs_label.strip(), additional_items

cli/tests/pcluster/templates/test_cluster_stack/test_head_node_dna_json/head_node_default.dna.json

@@ -20,6 +20,7 @@
     "efs_fs_ids": "",
     "efs_iam_authorizations": "",
     "efs_shared_dirs": "",
+    "efs_access_point_ids": "",
     "enable_intel_hpc_platform": "false",
     "ephemeral_dir": "/scratch",
     "fsx_dns_names": "",

cli/tests/pcluster/templates/test_login_nodes_stack/test_login_nodes_dna_json/dna-1.json

@@ -22,6 +22,7 @@
     "efs_fs_ids": "",
     "efs_iam_authorizations": "",
     "efs_shared_dirs": "",
+    "efs_access_point_ids": "",
     "enable_intel_hpc_platform": "false",
     "ephemeral_dir": "/scratch",
     "fsx_dns_names": "",

cli/tests/pcluster/templates/test_login_nodes_stack/test_login_nodes_dna_json/dna-2.json

@@ -22,6 +22,7 @@
     "efs_fs_ids": "",
     "efs_iam_authorizations": "",
     "efs_shared_dirs": "",
+    "efs_access_point_ids": "",
     "enable_intel_hpc_platform": "false",
     "ephemeral_dir": "/scratch",
     "fsx_dns_names": "",

cli/tests/pcluster/templates/test_queues_stack/test_compute_nodes_dna_json/dna-1.json

@@ -20,6 +20,7 @@
     "efs_fs_ids": "",
     "efs_iam_authorizations": "",
     "efs_shared_dirs": "",
+    "efs_access_point_ids": "",
     "enable_efa": "NONE",
     "enable_efa_gdr": "NONE",
     "enable_intel_hpc_platform": "false",

cli/tests/pcluster/templates/test_queues_stack/test_compute_nodes_dna_json/dna-2.json

@@ -20,6 +20,7 @@
     "efs_fs_ids": "",
     "efs_iam_authorizations": "",
     "efs_shared_dirs": "",
+    "efs_access_point_ids": "",
     "enable_efa": "NONE",
     "enable_efa_gdr": "NONE",
     "enable_intel_hpc_platform": "false",

cli/tests/pcluster/validators/test_efs_validators.py

@@ -11,7 +11,7 @@
 
 import pytest
 
-from pcluster.validators.efs_validators import EfsMountOptionsValidator
+from pcluster.validators.efs_validators import EfsMountOptionsValidator, EfsAccessPointOptionsValidator
 from tests.pcluster.validators.utils import assert_failure_messages
 
 
@@ -27,8 +27,8 @@
             False,
             True,
             "EFS IAM authorization cannot be enabled when encryption in-transit is disabled. "
-            "Please either disable IAM authorization or enable encryption in-transit for file system "
-            "<name-of-the-file-system>",
+            "Please either disable IAM authorization or enable encryption in-transit "
+            "for file system <name-of-the-file-system>",
         ),
         (
             True,
@@ -42,8 +42,72 @@
         ),
     ],
 )
-def test_efs_mount_options_validator(encryption_in_transit, iam_authorization, expected_message):
+def test_efs_mount_options_validator(
+    encryption_in_transit, iam_authorization, expected_message
+):
     actual_failures = EfsMountOptionsValidator().execute(
         encryption_in_transit, iam_authorization, "<name-of-the-file-system>"
     )
     assert_failure_messages(actual_failures, expected_message)
+
+
+@pytest.mark.parametrize(
+    "access_point_id, file_system_id, expected_message",
+    [
+        (
+            None,
+            None,
+            None,
+        ),
+        (
+            "<access_point_id>",
+            None,
+            "An access point can only be specified when using an existing EFS file system. "
+            "Please either remove the access point id <access_point_id> "
+            "or provide the file system id for the access point",
+        ),
+        (
+            "<access_point_id>",
+            "<file-systemd-id>",
+            None,
+        ),
+        (
+            None,
+            "<file-systemd-id>",
+            None,
+        ),
+    ],
+)
+def test_efs_access_point_with_filesystem_validator(access_point_id, file_system_id, expected_message):
+    actual_failures = EfsAccessPointOptionsValidator().execute(access_point_id, file_system_id, True)
+    assert_failure_messages(actual_failures, expected_message)
+
+@pytest.mark.parametrize(
+    "access_point_id, encryption_in_transit, expected_message",
+    [
+        (
+            None,
+            False,
+            None,
+        ),
+        (
+            "<access_point_id>",
+            False,
+            "An access point can only be specified when encryption in transit is enabled. "
+            "Please either remove the access point id <access_point_id> or enable encryption in transit.",
+        ),
+        (
+            "<access_point_id>",
+            True,
+            None,
+        ),
+        (
+            None,
+            True,
+            None,
+        ),
+    ],
+)
+def test_efs_access_point_with_filesystem_validator(access_point_id, encryption_in_transit, expected_message):
+    actual_failures = EfsAccessPointOptionsValidator().execute(access_point_id, "<file-system-id>", encryption_in_transit)
+    assert_failure_messages(actual_failures, expected_message)

tests/integration-tests/configs/develop.yaml

@@ -635,6 +635,12 @@ test-suites:
           instances: {{ common.INSTANCES_DEFAULT_X86 }}
           oss: ["rhel8"]
           schedulers: ["slurm"]
+    test_efs.py::test_efs_access_point:
+      dimensions:
+        - regions: ["us-east-2"]
+          instances: {{ common.INSTANCES_DEFAULT_X86 }}
+          oss: ["alinux2"]
+          schedulers: ["slurm"]
     test_raid.py::test_raid_fault_tolerance_mode:
       dimensions:
         - regions: ["cn-northwest-1"]

tests/integration-tests/conftest.py

@@ -54,7 +54,7 @@
 from jinja2.sandbox import SandboxedEnvironment
 from troposphere import Ref, Sub, Template, ec2, resourcegroups
 from troposphere.ec2 import PlacementGroup
-from troposphere.efs import FileSystem as EFSFileSystem
+from troposphere.efs import FileSystem as EFSFileSystem, AccessPoint as EFSAccessPoint
 from troposphere.efs import MountTarget
 from troposphere.fsx import (
     ClientConfigurations,
@@ -1785,6 +1785,32 @@ def create_efs(num=1):
         for stack in created_stacks:
             cfn_stacks_factory.delete_stack(stack.name, region)
 
+@pytest.fixture(scope="class")
+def efs_access_point_stack_factory(cfn_stacks_factory, request, region, vpc_stack):
+    """EFS stack contains a single efs and a single access point resource."""
+    created_stacks = []
+
+    def create_access_points(efs_fs_id, num=1):
+        ap_template = Template()
+        ap_template.set_version("2010-09-09")
+        ap_template.set_description("Access Point stack created for testing existing EFS wtith Access points")
+        access_point_resource_name = "AccessPointResourceResource"
+        for i in range(num):
+            access_point = EFSAccessPoint(f"{access_point_resource_name}{i}")
+            access_point.FileSystemId = efs_fs_id
+            ap_template.add_resource(access_point)
+        stack_name = generate_stack_name("integ-tests-efs-ap", request.config.getoption("stackname_suffix"))
+        stack = CfnStack(name=stack_name, region=region, template=ap_template.to_json())
+        cfn_stacks_factory.create_stack(stack)
+        created_stacks.append(stack)
+        return [stack.cfn_resources[f"{access_point_resource_name}{i}"] for i in range(num)]
+
+    yield create_access_points
+
+    if not request.config.getoption("no_delete"):
+        for stack in created_stacks:
+            cfn_stacks_factory.delete_stack(stack.name, region)
+
 
 @pytest.fixture(scope="class")
 def efs_mount_target_stack_factory(cfn_stacks_factory, request, region, vpc_stack):

tests/integration-tests/tests/storage/storage_common.py

@@ -222,7 +222,7 @@ def test_raid_correctly_mounted(remote_command_executor, mount_dir, volume_size)
 
 
 def write_file_into_efs(
-    region, vpc_stack: CfnVpcStack, efs_ids, request, key_name, cfn_stacks_factory, efs_mount_target_stack_factory
+    region, vpc_stack: CfnVpcStack, efs_ids, request, key_name, cfn_stacks_factory, efs_mount_target_stack_factory, access_point_id=None
 ):
     """Write file stack contains an instance to write an empty file with random name into each of the efs in efs_ids."""
     write_file_template = Template()
@@ -236,7 +236,7 @@ def write_file_into_efs(
     write_file_user_data = ""
     for efs_id in efs_ids:
         random_file_name = random_alphanumeric()
-        write_file_user_data += _write_user_data(efs_id, random_file_name)
+        write_file_user_data += _write_user_data(efs_id, random_file_name, access_point_id=access_point_id)
         random_file_names.append(random_file_name)
     user_data = f"""
         #cloud-config
@@ -312,11 +312,12 @@ def write_file_into_efs(
     return random_file_names
 
 
-def _write_user_data(efs_id, random_file_name):
+def _write_user_data(efs_id, random_file_name, access_point_id=None):
     mount_dir = "/mnt/efs/fs"
+    access_point_mount_parameter = f",accesspoint={access_point_id}" if access_point_id is not None else ""
     return f"""
         - mkdir -p {mount_dir}
-        - mount -t efs -o tls,iam {efs_id}:/ {mount_dir}
+        - mount -t efs -o tls,iam{access_point_mount_parameter} {efs_id}:/ {mount_dir} 
         - touch {mount_dir}/{random_file_name}
         - umount {mount_dir}
         """  # noqa: E501