[integ-tests] Verify the head node NFS server is configured for NFSv4-only and lockd does not bind port

Author: hanwen-cluster

CHANGELOG.md

@@ -13,7 +13,8 @@ CHANGELOG
   consistent with the existing limit for `Database`. This prevents runtime failures caused by MySQL's table name length limit.
 - The validator `MultiNetworkInterfacesInstancesValidator` now also covers single-network-card instances with EFA enabled, which are launched with multiple network interfaces and therefore cannot be auto-assigned a public IP.
 - The CLI now requires the additional permission `tag:GetResources`.
-- Add support for Python 3.11, 3.12 in pcluster CLI
+- Add support for Python 3.13 in pcluster CLI
+- Enforce NFSv4-only on the ParallelCluster-managed NFS server (head node). The NFSv3 client stack (rpcbind, rpc-statd, lockd) are unchanged, so cluster nodes can still mount external NFSv3 servers.
 
 **BUG FIXES**
 - Fix sporadic S3 bucket (with name parallelcluster-*-v1-do-not-delete) creation failure when multiple create-cluster commands are running simultaneously in the same region.

tests/integration-tests/tests/storage/storage_common.py

@@ -201,6 +201,27 @@ def test_ebs_correctly_mounted(remote_command_executor, mount_dir, volume_size):
     assert_that(result.stdout).matches(r"UUID=.* {mount_dir} ext4 _netdev 0 0".format(mount_dir=mount_dir))
 
 
+def assert_head_node_nfs_serves_v4_only(remote_command_executor):
+    """
+    Verify the head node NFS server is configured for NFSv4-only.
+
+    nfsd reports the versions it serves in /proc/fs/nfsd/versions, e.g. "-2 -3 +4 +4.1 +4.2"
+    ('+' enabled, '-' disabled).
+
+    Also assert the lock manager (nlockmgr/lockd) is not registered with rpcbind. Lock manager is used by v3, not v4.
+    """
+    logging.info("Checking the head node NFS server serves NFSv4 only")
+    versions = remote_command_executor.run_remote_command("sudo cat /proc/fs/nfsd/versions").stdout
+    # NFSv4 must be enabled and NFSv2/NFSv3 must be disabled.
+    assert_that(versions).contains("+4")
+    assert_that(versions).does_not_match(r"\+2(\s|$)")
+    assert_that(versions).does_not_match(r"\+3(\s|$)")
+
+    # lockd must not be brought up: no nlockmgr registered with rpcbind on the head node.
+    rpcinfo = remote_command_executor.run_remote_command("rpcinfo -p localhost").stdout
+    assert_that(rpcinfo).does_not_contain("nlockmgr")
+
+
 # for RAID
 
 

tests/integration-tests/tests/storage/test_ebs.py

@@ -20,6 +20,7 @@
 
 from tests.storage.kms_key_factory import KMSKeyFactory
 from tests.storage.storage_common import (
+    assert_head_node_nfs_serves_v4_only,
     assert_subnet_az_relations_from_config,
     test_directory_correctly_shared_between_ln_and_hn,
     test_ebs_correctly_mounted,
@@ -58,6 +59,8 @@ def test_ebs_single(
     # Test ebs correctly shared between HeadNode and ComputeNodes
     _test_ebs_correctly_shared(remote_command_executor_head_node, mount_dir, scheduler_commands)
 
+    assert_head_node_nfs_serves_v4_only(remote_command_executor_head_node)
+
     remote_command_executor_login_node = RemoteCommandExecutor(cluster, use_login_node=True)
     # Test ebs correctly shared between LoginNode and ComputeNodes
     _test_ebs_correctly_shared(remote_command_executor_login_node, mount_dir, scheduler_commands)