Extend MultiNetworkInterfacesInstancesValidator to cover single-card EFA instances (#7457)

Since 3.15.0, single-network-card instances with EFA enabled (e.g. hpc6a,
c5n) are launched with two network interfaces (a primary interface plus a
dedicated efa-only interface), so AWS does not auto-assign them a public IP.
Previously MultiNetworkInterfacesInstancesValidator only checked
multi-network-card instances, so these queues passed validation and their
compute nodes silently failed to bootstrap on public subnets without a NAT
gateway.

Broaden the validator to also flag single-card EFA compute resources (mirroring
the launch-template logic in queues_stack.add_network_interfaces, including the
EfaInterfaceType: efa opt-out), and rework the failure messages to name the
responsible instance types, explain why they launch multiple interfaces, and
give a branch-specific workaround.

Co-authored-by: hanwen-cluster <hanwenli@amazon.com>

Author: hehe7318

CHANGELOG.md

@@ -11,6 +11,7 @@ CHANGELOG
 **CHANGES**
 - The validator `ClusterNameValidator` now enforces cluster names to be limited to 40 characters when using `ExternalSlurmdbd`, 
   consistent with the existing limit for `Database`. This prevents runtime failures caused by MySQL's table name length limit.
+- The validator `MultiNetworkInterfacesInstancesValidator` now also covers single-network-card instances with EFA enabled, which are launched with multiple network interfaces and therefore cannot be auto-assigned a public IP.
 - The CLI now requires the additional permission `tag:GetResources`.
 - Add support for Python 3.11, 3.12 in pcluster CLI
 

cli/src/pcluster/config/cluster_config.py

@@ -67,6 +67,7 @@
     Feature,
 )
 from pcluster.utils import (
+    get_attr,
     get_partition,
     get_resource_name_from_resource_arn,
     to_snake_case,
@@ -3015,7 +3016,11 @@ def _register_validators(self, context: ValidatorContext = None):  # noqa: C901
             )
 
         instance_types_data = self.get_instance_types_data()
-        self._register_validator(MultiNetworkInterfacesInstancesValidator, queues=self.scheduling.queues)
+        self._register_validator(
+            MultiNetworkInterfacesInstancesValidator,
+            queues=self.scheduling.queues,
+            efa_interface_type=get_attr(self, "dev_settings.efa_interface_type"),
+        )
         checked_images = []
         capacity_reservation_id_max_count_map = {}
         total_max_compute_nodes = 0

cli/src/pcluster/validators/cluster_validators.py

@@ -1538,14 +1538,73 @@ def _validate(self, encryption_settings: list):
 
 
 class MultiNetworkInterfacesInstancesValidator(Validator):
-    """Verify that queues with multi nic compute resources don't auto-assign public IPs or contain subnets that do."""
+    """Verify that queues launching multiple network interfaces don't auto-assign public IPs or use subnets that do."""
 
-    def _validate(self, queues):
+    # Shared statement of the underlying AWS limitation.
+    _PUBLIC_IP_LIMITATION = (
+        "AWS can't auto-assign a public IP to instances launched with more than one network interface."
+    )
+
+    @staticmethod
+    def _multiple_network_interfaces_reason(compute_resource, efa_interface_type):
+        """Return why the compute resource is launched with more than one network interface, or None.
+
+        Two cases produce more than one network interface, which must be kept in sync with
+        templates/queues_stack.py::add_network_interfaces:
+        - "multi_card": multi-network-card instances (e.g. p4d, hpc6id) attach a network interface per network card.
+        - "efa": single-network-card instances with EFA enabled (e.g. hpc6a, c5n), for which ParallelCluster attaches
+          a primary interface plus a dedicated efa-only interface (unless the EfaInterfaceType: efa opt-out is set or
+          the primary network card cannot hold 2 network interfaces).
+        """
+        if compute_resource.max_network_cards > 1:
+            return "multi_card"
+
+        efa_enabled = compute_resource.efa and compute_resource.efa.enabled
+        use_legacy_efa = efa_interface_type == "efa"
+        nci0_supports_efa = compute_resource.max_efa_interfaces == compute_resource.max_network_cards
+        nci0_max_enis = (
+            compute_resource.network_cards_list[0].maximum_network_interfaces()
+            if compute_resource.network_cards_list
+            else 1
+        )
+        if efa_enabled and not use_legacy_efa and nci0_supports_efa and nci0_max_enis >= 2:
+            return "efa"
+        return None
+
+    def _reason_clause(self, queue, efa_interface_type):
+        """Return a queue-level clause explaining why the queue's instances launch multiple network interfaces.
+
+        A queue may contain both kinds of compute resources, so include every applicable reason along with the
+        instance types responsible for it.
+        """
+        instance_types_by_reason = {"multi_card": [], "efa": []}
+        for compute_resource in queue.compute_resources:
+            reason = self._multiple_network_interfaces_reason(compute_resource, efa_interface_type)
+            if reason:
+                instance_types_by_reason[reason].extend(compute_resource.instance_types)
+
+        clauses = []
+        if instance_types_by_reason["multi_card"]:
+            # Instance types with multiple network cards are launched with one network interface per card.
+            types = ", ".join(sorted(set(instance_types_by_reason["multi_card"])))
+            clauses.append(f"contains the instance types {types} with multiple network interfaces")
+        if instance_types_by_reason["efa"]:
+            # Single-network-card instances launched with a primary interface plus an efa-only interface (EFA enabled).
+            types = ", ".join(sorted(set(instance_types_by_reason["efa"])))
+            clauses.append(
+                f"has EFA enabled on the single-network-card instance types {types}, so its compute nodes are "
+                f"launched with multiple network interfaces (a primary interface plus a dedicated efa-only interface)"
+            )
+        return " and ".join(clauses)
+
+    def _validate(self, queues, efa_interface_type=None):
         multi_nic_queues = [
             queue
             for queue in queues
-            for compute_resource in queue.compute_resources
-            if compute_resource.max_network_cards > 1
+            if any(
+                self._multiple_network_interfaces_reason(compute_resource, efa_interface_type)
+                for compute_resource in queue.compute_resources
+            )
         ]
 
         all_subnets_with_public_ips = {
@@ -1557,11 +1616,12 @@ def _validate(self, queues):
         }
 
         for queue in multi_nic_queues:
+            reason_clause = self._reason_clause(queue, efa_interface_type)
             if queue.networking.assign_public_ip:
                 self._add_failure(
-                    f"The queue {queue.name} contains an instance type with multiple network interfaces however the "
-                    f"AssignPublicIp value is set to true. AWS public IPs can only be assigned to instances launched "
-                    f"with a single network interface.",
+                    f"The queue {queue.name} {reason_clause}, but AssignPublicIp is set to true. "
+                    f"{self._PUBLIC_IP_LIMITATION} Set AssignPublicIp to false and use a private subnet with a NAT "
+                    f"gateway to provide internet access to the compute nodes.",
                     FailureLevel.ERROR,
                 )
 
@@ -1570,8 +1630,8 @@ def _validate(self, queues):
             )
             if queue_subnets_with_public_ips:
                 self._add_failure(
-                    f"The queue {queue.name} contains an instance type with multiple network interfaces however the "
-                    f"subnets {queue_subnets_with_public_ips} is configured to automatically assign public IPs. AWS "
-                    f"public IPs can only be assigned to instances launched with a single network interface.",
+                    f"The queue {queue.name} {reason_clause}, but the subnets {queue_subnets_with_public_ips} "
+                    f"auto-assign public IPs. {self._PUBLIC_IP_LIMITATION} Use a private subnet with a NAT gateway to "
+                    f"provide internet access to the compute nodes.",
                     FailureLevel.ERROR,
                 )