fix nfs security group to be able to mount efs to new node group

Kookster310 · Mar 13, 2026 · Mar 13, 2026 · Mar 13, 2026 · Mar 13, 2026 · Mar 13, 2026
commit d44f8bff688254bc5e064cf93a6c0e88bdf69685
diff --git a/.github/scripts/create-perf-nodegroup.sh b/.github/scripts/create-perf-nodegroup.sh
@@ -1,12 +1,14 @@
 #!/usr/bin/env bash
 # Create a dedicated EKS node group for performance tests.
-# Usage: INSTANCE=<10-char-id> [EKS_CLUSTER_NAME=pm4-eng] [AWS_REGION=us-east-1] ./create-perf-nodegroup.sh
-# Requires: aws CLI, credentials with eks:CreateNodegroup and eks:DescribeCluster, eks:ListNodegroups, eks:DescribeNodegroup
+# Usage: INSTANCE=<10-char-id> [EKS_CLUSTER_NAME=pm4-eng] [AWS_REGION=us-east-1] [EFS_SECURITY_GROUP_ID=sg-...] ./create-perf-nodegroup.sh
+# Requires: aws CLI, credentials with eks:CreateNodegroup, eks:DescribeCluster, ec2:DescribeInstances, ec2:AuthorizeSecurityGroupIngress
 set -euo pipefail
 
 INSTANCE="${INSTANCE:?INSTANCE is required (10-char instance id)}"
 EKS_CLUSTER_NAME="${EKS_CLUSTER_NAME:-pm4-eng}"
 AWS_REGION="${AWS_REGION:-us-east-1}"
+# EFS mount target security group; must allow NFS (2049) from perf nodes so they can mount EFS.
+EFS_SECURITY_GROUP_ID="${EFS_SECURITY_GROUP_ID:-sg-019a2068045d7a240}"
 NODEGROUP_NAME="perf-ci-${INSTANCE}"
 TAINT_KEY="performance"
 TAINT_VALUE="ci-${INSTANCE}"
@@ -58,3 +60,32 @@ aws eks wait nodegroup-active \
   --nodegroup-name "${NODEGROUP_NAME}" \
   --region "${AWS_REGION}"
 echo "Node group ${NODEGROUP_NAME} is ACTIVE."
+
+# Allow NFS (port 2049) from perf node group to EFS so pods can mount efs-sc volumes.
+echo "Allowing NFS from perf node group into EFS security group ${EFS_SECURITY_GROUP_ID}..."
+max_tries=12
+for i in $(seq 1 "${max_tries}"); do
+  NODE_SGS=$(aws ec2 describe-instances --region "${AWS_REGION}" \
+    --filters "Name=tag:eks:nodegroup-name,Values=${NODEGROUP_NAME}" "Name=instance-state-name,Values=running" \
+    --query 'Reservations[].Instances[].SecurityGroups[].GroupId' --output text | tr '\t' '\n' | sort -u)
+  if [ -n "${NODE_SGS}" ]; then
+    break
+  fi
+  echo "Waiting for instances in ${NODEGROUP_NAME} (attempt ${i}/${max_tries})..."
+  sleep 10
+done
+if [ -z "${NODE_SGS}" ]; then
+  echo "WARNING: No instances found in ${NODEGROUP_NAME}; skipping EFS SG rule. EFS mounts may fail."
+  exit 0
+fi
+for sg in ${NODE_SGS}; do
+  if [ "${sg}" = "${EFS_SECURITY_GROUP_ID}" ]; then
+    continue
+  fi
+  echo "Adding inbound rule to ${EFS_SECURITY_GROUP_ID}: TCP 2049 from ${sg}"
+  aws ec2 authorize-security-group-ingress --region "${AWS_REGION}" \
+    --group-id "${EFS_SECURITY_GROUP_ID}" \
+    --protocol tcp --port 2049 \
+    --source-group "${sg}" 2>/dev/null || echo "Rule may already exist; continuing."
+done
+echo "EFS security group updated."
diff --git a/.github/scripts/delete-perf-nodegroup.sh b/.github/scripts/delete-perf-nodegroup.sh
@@ -1,12 +1,13 @@
 #!/usr/bin/env bash
 # Delete the dedicated EKS node group for performance tests.
-# Usage: INSTANCE=<10-char-id> [EKS_CLUSTER_NAME=pm4-eng] [AWS_REGION=us-east-1] ./delete-perf-nodegroup.sh
+# Usage: INSTANCE=<10-char-id> [EKS_CLUSTER_NAME=pm4-eng] [AWS_REGION=us-east-1] [EFS_SECURITY_GROUP_ID=sg-...] ./delete-perf-nodegroup.sh
 # Idempotent: no-op if node group does not exist.
 set -euo pipefail
 
 INSTANCE="${INSTANCE:?INSTANCE is required (10-char instance id)}"
 EKS_CLUSTER_NAME="${EKS_CLUSTER_NAME:-pm4-eng}"
 AWS_REGION="${AWS_REGION:-us-east-1}"
+EFS_SECURITY_GROUP_ID="${EFS_SECURITY_GROUP_ID:-sg-019a2068045d7a240}"
 NODEGROUP_NAME="perf-ci-${INSTANCE}"
 
 if ! aws eks describe-nodegroup \
@@ -17,6 +18,23 @@ if ! aws eks describe-nodegroup \
   exit 0
 fi
 
+# Revoke NFS from perf node group in EFS SG before instances are gone
+NODE_SGS=$(aws ec2 describe-instances --region "${AWS_REGION}" \
+  --filters "Name=tag:eks:nodegroup-name,Values=${NODEGROUP_NAME}" "Name=instance-state-name,Values=running,pending,stopping,stopped" \
+  --query 'Reservations[].Instances[].SecurityGroups[].GroupId' --output text | tr '\t' '\n' | sort -u)
+if [ -n "${NODE_SGS}" ]; then
+  for sg in ${NODE_SGS}; do
+    if [ "${sg}" = "${EFS_SECURITY_GROUP_ID}" ]; then
+      continue
+    fi
+    echo "Revoking inbound rule from ${EFS_SECURITY_GROUP_ID}: TCP 2049 from ${sg}"
+    aws ec2 revoke-security-group-ingress --region "${AWS_REGION}" \
+      --group-id "${EFS_SECURITY_GROUP_ID}" \
+      --protocol tcp --port 2049 \
+      --source-group "${sg}" 2>/dev/null || true
+  done
+fi
+
 echo "Deleting node group: ${NODEGROUP_NAME}"
 aws eks delete-nodegroup \
   --cluster-name "${EKS_CLUSTER_NAME}" \