Allow "." and long usernames in the DCV authenticator

CHANGELOG.md

@@ -11,9 +11,14 @@ This file is used to list changes made in each version of the AWS ParallelCluste
 - Further reduce transient build-image failures on RHEL and Rocky caused by out-of-sync repo mirrors by resetting metadata upon retry.
 - Improve cluster update resiliency on login nodes by reusing the head-node-driven orchestration already in place on compute nodes, 
   removing the dependency on cfn-hup and cfn-init.
+- Support usernames longer than 8 characters and usernames with `.` in DCV authenticator.
 
 
 **CHANGES**
+- Enforce NFSv4-only on the ParallelCluster-managed NFS server (head node). NFSv3 can be
+  re-enabled on the server by overriding the `nfs/v3` attribute to `'yes'`. The NFSv3 client
+  stack (rpcbind, rpc-statd, lockd) and its statically pinned ports are unchanged, so cluster
+  nodes can still mount external NFSv3 servers through a restricted firewall.
 - In GPU Health Check, skip DCGM diagnostics when NVIDIA MIG is enabled because dcgmi diag does not support MIG.
 
 **CHANGES**

cookbooks/aws-parallelcluster-environment/attributes/environment.rb

@@ -5,6 +5,11 @@
 # For performance, set NFS threads to min(256, max(8, num_cores * 4))
 default['cluster']['nfs']['threads'] = [[node['cpu']['cores'].to_i * 4, 8].max, 256].min
 
+# Enforce NFSv4-only on the ParallelCluster-managed NFS server.
+default['nfs']['v4'] = 'yes'
+default['nfs']['v3'] = 'no'
+default['nfs']['v2'] = 'no'
+
 # Kernel release version used to select Lustre version
 # This is a mechanism used to mock kernel release on docker system-tests, see kitchen.docker.yml:
 # when kernel_release is defined, it will be used, otherwise the release version will be taken from ohai.

cookbooks/aws-parallelcluster-environment/resources/nfs/nfs_alinux2023.rb

@@ -27,12 +27,3 @@
   action_install_nfs4
   action_disable_start_at_boot
 end
-
-action_class do
-  def override_server_template
-    edit_resource(:template, node['nfs']['config']['server_template']) do
-      source 'nfs/default-nfs-kernel-server.conf.erb'
-      cookbook 'aws-parallelcluster-environment'
-    end
-  end
-end

cookbooks/aws-parallelcluster-environment/resources/nfs/nfs_redhat8.rb

@@ -27,11 +27,3 @@
   action_install_nfs4
   action_disable_start_at_boot
 end
-
-action_class do
-  def override_server_template
-    edit_resource(:template, node['nfs']['config']['server_template']) do
-      cookbook 'nfs'
-    end
-  end
-end

cookbooks/aws-parallelcluster-environment/resources/nfs/nfs_rocky8.rb

@@ -27,11 +27,3 @@
   action_install_nfs4
   action_disable_start_at_boot
 end
-
-action_class do
-  def override_server_template
-    edit_resource(:template, node['nfs']['config']['server_template']) do
-      cookbook 'nfs'
-    end
-  end
-end

cookbooks/aws-parallelcluster-environment/resources/nfs/nfs_ubuntu22+.rb

@@ -30,13 +30,3 @@
   action_install_nfs4
   action_disable_start_at_boot
 end
-
-action_class do
-  def override_server_template
-    node.default['nfs']['config']['server_template'] = '/etc/nfs.conf.d/parallelcluster-nfs.conf'
-    edit_resource(:template, node['nfs']['config']['server_template']) do
-      source 'nfs/nfs-ubuntu22+.conf.erb'
-      cookbook 'aws-parallelcluster-environment'
-    end
-  end
-end

cookbooks/aws-parallelcluster-environment/resources/nfs/partial/_configure.rb

@@ -16,13 +16,10 @@
 action :configure do
   if node['cluster']['node_type'] == "HeadNode"
     node.force_override['nfs']['threads'] = node['cluster']['nfs']['threads']
+    render_server_config
 
-    override_server_template
-
-    # Explicitly restart NFS server for thread setting to take effect
-    # and enable it to start at boot
     service node['nfs']['service']['server'] do
-      action %i(restart enable)
+      action %i(enable start)
       supports restart: true
       retries 5
       retry_delay 10
@@ -33,3 +30,35 @@
     end unless on_docker?
   end
 end
+
+action_class do
+  def render_server_config
+    server_service = node['nfs']['service']['server']
+
+    if conf_d_supported?
+      directory '/etc/nfs.conf.d' do
+        mode '0755'
+      end
+
+      template '/etc/nfs.conf.d/parallelcluster-nfs.conf' do
+        source 'nfs/parallelcluster-nfs.conf.erb'
+        cookbook 'aws-parallelcluster-environment'
+        mode '0644'
+        notifies :restart, "service[#{server_service}]", :delayed
+      end
+    else
+      template '/etc/nfs.conf' do
+        source 'nfs/nfs.conf.erb'
+        cookbook 'aws-parallelcluster-environment'
+        mode '0644'
+        notifies :restart, "service[#{server_service}]", :delayed
+      end
+    end
+  end
+
+  # /etc/nfs.conf.d/*.conf auto-include requires nfs-utils >= ~2.4.1. The only supported platform
+  # older than that is RHEL/Rocky 8 (nfs-utils 2.3.3), where we render /etc/nfs.conf directly.
+  def conf_d_supported?
+    !(platform_family?('rhel') && node['platform_version'].to_i == 8)
+  end
+end

cookbooks/aws-parallelcluster-environment/spec/unit/resources/nfs_spec.rb

@@ -21,10 +21,10 @@ def self.configure(chef_run)
 describe 'nfs:setup' do
   for_all_oses do |platform, version|
     context "on #{platform}#{version}" do
-      cached(:disabled_service) { 'disable_service' }
+      cached(:server_service) { 'nfs_server_service' }
       cached(:chef_run) do
         runner = runner(platform: platform, version: version, step_into: ['nfs']) do |node|
-          node.override['nfs']['service']['server'] = disabled_service
+          node.override['nfs']['service']['server'] = server_service
         end
         ConvergeNfs.setup(runner)
       end
@@ -33,42 +33,38 @@ def self.configure(chef_run)
         is_expected.to setup_nfs('setup')
       end
 
-      if %w(amazon centos redhat).include?(platform)
-        it 'installs nfs::server4' do
-          expect(chef_run).to include_recipe('nfs::server4')
-          chef_run
-        end
+      it 'installs the full NFS stack (client + server) via nfs::server4' do
+        expect(chef_run).to include_recipe('nfs::server4')
+        chef_run
+      end
 
-      elsif platform == 'ubuntu'
-        it 'installs nfs::server and nfs:server4' do
+      if %w(ubuntu debian).include?(platform)
+        it 'also includes nfs::server on Debian (sous-chefs/nfs#93 workaround)' do
           expect(chef_run).to include_recipe('nfs::server')
-          expect(chef_run).to include_recipe('nfs::server4')
           chef_run
         end
-
-      else
-        pending "to be implemented"
       end
 
-      it 'disables service at boot' do
-        is_expected.to disable_service(disabled_service)
+      it 'does not start the nfs server at boot' do
+        is_expected.to disable_service(server_service)
       end
     end
   end
 end
 
 describe 'nfs:configure' do
   for_all_oses do |platform, version|
+    cached(:server_service) { 'nfs_server_service' }
+    cached(:nfs_conf) { '/etc/nfs.conf' }
+    cached(:nfs_conf_dropin) { '/etc/nfs.conf.d/parallelcluster-nfs.conf' }
+
     context "on #{platform}#{version} on node type HeadNode" do
       cached(:threads) { 10 }
-      cached(:server_template) { 'server_template' }
-      cached(:nfs_service) { 'nfs_service' }
       cached(:chef_run) do
         runner = runner(platform: platform, version: version, step_into: ['nfs']) do |node|
+          node.override['nfs']['service']['server'] = server_service
           node.override['cluster']['nfs']['threads'] = threads
-          node.override['nfs']['config']['server_template'] = server_template
-          node.override['nfs']['service']['server'] = nfs_service
-          node.override['cluster']['node_type'] = "HeadNode"
+          node.override['cluster']['node_type'] = 'HeadNode'
         end
         ConvergeNfs.configure(runner)
       end
@@ -77,50 +73,74 @@ def self.configure(chef_run)
         is_expected.to configure_nfs('configure')
       end
 
-      if %w(amazon centos).include?(platform)
-        it 'overrides nfs config with custom template' do
-          is_expected.to create_template(server_template)
-            .with(source: 'nfs/default-nfs-kernel-server.conf.erb')
+      if %w(redhat rocky centos).include?(platform) && version.to_i == 8
+        it 'renders /etc/nfs.conf with the NFSv4-only template (no conf.d on el8)' do
+          is_expected.to create_template(nfs_conf)
+            .with(source: 'nfs/nfs.conf.erb')
             .with(cookbook: 'aws-parallelcluster-environment')
+          is_expected.to_not create_template(nfs_conf_dropin)
         end
 
-      elsif %w(ubuntu).include?(platform)
-        it 'overrides nfs config with custom template' do
-          if version.to_i >= 22
-            is_expected.to create_template(server_template)
-              .with(source: 'nfs/nfs-ubuntu22+.conf.erb')
-              .with(cookbook: 'aws-parallelcluster-environment')
-          else
-            is_expected.to create_template(server_template)
-              .with(source: 'nfs/default-nfs-kernel-server.conf.erb')
-              .with(cookbook: 'aws-parallelcluster-environment')
-          end
+        it 'disables NFSv3 and enables NFSv4 in /etc/nfs.conf' do
+          expect(chef_run).to render_file(nfs_conf).with_content(/vers3=no/)
+          expect(chef_run).to render_file(nfs_conf).with_content(/vers4=yes/)
         end
 
-      elsif %(redhat rocky).include?(platform)
-        it 'uses nfs config template shipped with nfs cookbook' do
-          is_expected.to create_template(server_template)
-            .with(source: "#{server_template}.erb")
-            .with(cookbook: 'nfs')
+        it 'restart of the server is notified when /etc/nfs.conf changes' do
+          expect(chef_run.template(nfs_conf)).to notify("service[#{server_service}]").to(:restart).delayed
         end
-
       else
-        pending "to be implemented"
+        it 'ships an NFSv4-only drop-in and leaves /etc/nfs.conf untouched' do
+          is_expected.to create_template(nfs_conf_dropin)
+            .with(source: 'nfs/parallelcluster-nfs.conf.erb')
+            .with(cookbook: 'aws-parallelcluster-environment')
+          is_expected.to_not create_template(nfs_conf)
+        end
+
+        it 'disables NFSv3 and enables NFSv4 in the drop-in' do
+          expect(chef_run).to render_file(nfs_conf_dropin).with_content(/vers3=no/)
+          expect(chef_run).to render_file(nfs_conf_dropin).with_content(/vers4=yes/)
+        end
+
+        it 'pins the ancillary v3 client ports in the drop-in (unpinned by nfs::server4 on AL2023)' do
+          expect(chef_run).to render_file(nfs_conf_dropin).with_content(/\[statd\]\nport=32765\noutgoing-port=32766/)
+          expect(chef_run).to render_file(nfs_conf_dropin).with_content(/\[mountd\]\nport=32767/)
+          expect(chef_run).to render_file(nfs_conf_dropin).with_content(/\[lockd\]\nport=32768\nudp-port=32768/)
+        end
+
+        it 'restart of the server is notified when the drop-in changes' do
+          expect(chef_run.template(nfs_conf_dropin)).to notify("service[#{server_service}]").to(:restart).delayed
+        end
       end
 
-      it 'enables and restarts service' do
-        is_expected.to restart_service(nfs_service)
-          .with(action: %i(restart enable))
-          .with(supports: { restart: true })
+      it 'enables and starts the server' do
+        is_expected.to enable_service(server_service)
+        is_expected.to start_service(server_service)
+      end
+
+      context 'when v3 is re-enabled via node attribute' do
+        cached(:chef_run) do
+          runner = runner(platform: platform, version: version, step_into: ['nfs']) do |node|
+            node.override['nfs']['service']['server'] = server_service
+            node.override['cluster']['nfs']['threads'] = threads
+            node.override['nfs']['v3'] = 'yes'
+            node.override['cluster']['node_type'] = 'HeadNode'
+          end
+          ConvergeNfs.configure(runner)
+        end
+
+        it 'advertises vers3 in the rendered config' do
+          target = (%w(redhat rocky centos).include?(platform) && version.to_i == 8) ? nfs_conf : nfs_conf_dropin
+          expect(chef_run).to render_file(target).with_content(/vers3=yes/)
+        end
       end
     end
 
     context "on #{platform}#{version} on node type ComputeFleet" do
-      cached(:server_template) { 'server_template' }
-      cached(:nfs_service) { 'nfs_service' }
       cached(:chef_run) do
         runner = runner(platform: platform, version: version, step_into: ['nfs']) do |node|
-          node.override['cluster']['node_type'] = "ComputeFleet"
+          node.override['nfs']['service']['server'] = server_service
+          node.override['cluster']['node_type'] = 'ComputeFleet'
         end
         ConvergeNfs.configure(runner)
       end
@@ -129,12 +149,14 @@ def self.configure(chef_run)
         is_expected.to configure_nfs('configure')
       end
 
-      it 'not overrides nfs config with custom template' do
-        is_expected.to_not create_template(server_template)
+      it 'does not manage the NFS server config (client-only node)' do
+        is_expected.to_not create_template(nfs_conf)
+        is_expected.to_not create_template(nfs_conf_dropin)
       end
 
-      it 'not enables and restarts service' do
-        is_expected.to_not restart_service(nfs_service)
+      it 'stops and disables the server (client-only node)' do
+        is_expected.to stop_service(server_service)
+        is_expected.to disable_service(server_service)
       end
     end
   end