AWS parallelcluster documentation change
Summary
Updated EFA network interface documentation and added note about public IP assignment limitations
Security assessment
Clarifies secure network configuration requirements (private subnets + NAT) for EFA nodes, promoting reduced attack surface. No specific vulnerability addressed.
Diff
diff --git a/parallelcluster/latest/ug/efa-v3.md b/parallelcluster/latest/ug/efa-v3.md index 44c6c276b..098c1fc2c 100644 --- a//parallelcluster/latest/ug/efa-v3.md +++ b//parallelcluster/latest/ug/efa-v3.md @@ -29 +29 @@ By default, Ubuntu distributions enable ptrace (process trace) protection. ptrac -Starting in AWS ParallelCluster 3.15.0, when EFA is enabled, AWS ParallelCluster automatically configures EFA-only network interfaces to separate EFA traffic from IP traffic. This maximizes EFA bandwidth while minimizing IP address consumption. AWS ParallelCluster determines the optimal configuration based on the capabilities of the instance type. +Starting in AWS ParallelCluster 3.15.0, when EFA is enabled, AWS ParallelCluster automatically configures EFA-only network interfaces to separate EFA traffic from IP traffic. This maximizes EFA bandwidth while minimizing IP address consumption. AWS ParallelCluster determines the optimal configuration based on the capabilities of the instance type. Therefore, EFA-enabled compute nodes are launched with more than one network interface, even when they use a single-network-card instance type, provided that instance type supports more than one network interface. @@ -32,0 +33,4 @@ This default configuration is recommended for most workloads, including tightly- +###### Note + +Amazon EC2 does not auto-assign a public IP address to an instance launched with more than one network interface. EFA-enabled compute nodes launch with multiple network interfaces. These compute nodes fail to bootstrap if they rely on an auto-assigned public IP for internet access (a public subnet with no NAT gateway). Place these compute nodes in a private subnet with a [NAT gateway](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) and set [AssignPublicIp](./Scheduling-v3.html#yaml-Scheduling-SlurmQueues-Networking-AssignPublicIp) to `false`. This requirement previously applied only to instance types with multiple network cards. +