aws-parallelcluster 3.14.2__tar.gz → 3.15.1__tar.gz

{aws_parallelcluster-3.14.2 → aws_parallelcluster-3.15.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-parallelcluster
-Version: 3.14.2
+Version: 3.15.1
 Summary: AWS ParallelCluster is an AWS supported Open Source cluster management tool to deploy and manage HPC clusters in the AWS cloud.
 Home-page: https://github.com/aws/aws-parallelcluster
 Author: Amazon Web Services
@@ -21,7 +21,7 @@ Classifier: License :: OSI Approved :: Apache Software License
 Requires-Python: >=3.9
 Requires-Dist: setuptools
 Requires-Dist: boto3>=1.39.4
-Requires-Dist: tabulate<=0.8.10,>=0.8.8
+Requires-Dist: tabulate<=0.9.0,>=0.8.8
 Requires-Dist: PyYAML!=5.4,>=5.3.1
 Requires-Dist: jinja2~=3.0
 Requires-Dist: marshmallow~=3.10
@@ -44,7 +44,7 @@ Requires-Dist: aws-cdk.aws-ssm~=1.164
 Requires-Dist: aws-cdk.aws-sqs~=1.164
 Requires-Dist: aws-cdk.aws-cloudformation~=1.164
 Requires-Dist: connexion~=2.15.1
-Requires-Dist: jmespath~=0.10
+Requires-Dist: jmespath~=1.0
 Requires-Dist: jsii==1.85.0
 Requires-Dist: werkzeug~=3.1
 Requires-Dist: flask~=3.1.0

{aws_parallelcluster-3.14.2 → aws_parallelcluster-3.15.1}/setup.py

@@ -20,12 +20,12 @@ def readme():
         return f.read()
 
 
-VERSION = "3.14.2"
+VERSION = "3.15.1"
 CDK_VERSION = "1.164"
 REQUIRES = [
     "setuptools",
     "boto3>=1.39.4",
-    "tabulate>=0.8.8,<=0.8.10",
+    "tabulate>=0.8.8,<=0.9.0",
     "PyYAML>=5.3.1,!=5.4",
     "jinja2~=3.0",
     "marshmallow~=3.10",
@@ -48,7 +48,7 @@ REQUIRES = [
     "aws-cdk.aws-sqs~=" + CDK_VERSION,
     "aws-cdk.aws-cloudformation~=" + CDK_VERSION,
     "connexion~=2.15.1",
-    "jmespath~=0.10",
+    "jmespath~=1.0",
     "jsii==1.85.0",
     "werkzeug~=3.1",
     "flask~=3.1.0",

{aws_parallelcluster-3.14.2 → aws_parallelcluster-3.15.1}/src/aws_parallelcluster.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-parallelcluster
-Version: 3.14.2
+Version: 3.15.1
 Summary: AWS ParallelCluster is an AWS supported Open Source cluster management tool to deploy and manage HPC clusters in the AWS cloud.
 Home-page: https://github.com/aws/aws-parallelcluster
 Author: Amazon Web Services
@@ -21,7 +21,7 @@ Classifier: License :: OSI Approved :: Apache Software License
 Requires-Python: >=3.9
 Requires-Dist: setuptools
 Requires-Dist: boto3>=1.39.4
-Requires-Dist: tabulate<=0.8.10,>=0.8.8
+Requires-Dist: tabulate<=0.9.0,>=0.8.8
 Requires-Dist: PyYAML!=5.4,>=5.3.1
 Requires-Dist: jinja2~=3.0
 Requires-Dist: marshmallow~=3.10
@@ -44,7 +44,7 @@ Requires-Dist: aws-cdk.aws-ssm~=1.164
 Requires-Dist: aws-cdk.aws-sqs~=1.164
 Requires-Dist: aws-cdk.aws-cloudformation~=1.164
 Requires-Dist: connexion~=2.15.1
-Requires-Dist: jmespath~=0.10
+Requires-Dist: jmespath~=1.0
 Requires-Dist: jsii==1.85.0
 Requires-Dist: werkzeug~=3.1
 Requires-Dist: flask~=3.1.0

{aws_parallelcluster-3.14.2 → aws_parallelcluster-3.15.1}/src/aws_parallelcluster.egg-info/SOURCES.txt

@@ -229,7 +229,6 @@ src/pcluster/validators/iam_validators.py
 src/pcluster/validators/imagebuilder_validators.py
 src/pcluster/validators/instances_validators.py
 src/pcluster/validators/kms_validators.py
-src/pcluster/validators/login_nodes_validators.py
 src/pcluster/validators/monitoring_validators.py
 src/pcluster/validators/networking_validators.py
 src/pcluster/validators/s3_validators.py

{aws_parallelcluster-3.14.2 → aws_parallelcluster-3.15.1}/src/aws_parallelcluster.egg-info/requires.txt

@@ -1,6 +1,6 @@
 setuptools
 boto3>=1.39.4
-tabulate<=0.8.10,>=0.8.8
+tabulate<=0.9.0,>=0.8.8
 PyYAML!=5.4,>=5.3.1
 jinja2~=3.0
 marshmallow~=3.10
@@ -23,7 +23,7 @@ aws-cdk.aws-ssm~=1.164
 aws-cdk.aws-sqs~=1.164
 aws-cdk.aws-cloudformation~=1.164
 connexion~=2.15.1
-jmespath~=0.10
+jmespath~=1.0
 jsii==1.85.0
 werkzeug~=3.1
 flask~=3.1.0

{aws_parallelcluster-3.14.2 → aws_parallelcluster-3.15.1}/src/pcluster/api/openapi/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.0.2
 info:
   description: ParallelCluster API
   title: ParallelCluster
-  version: 3.14.2
+  version: 3.15.1
 servers:
 - url: /
 # override: auth is defined the the API GW level

{aws_parallelcluster-3.14.2 → aws_parallelcluster-3.15.1}/src/pcluster/aws/aws_resources.py

@@ -268,8 +268,10 @@ class InstanceTypeInfo:
         return len(self.network_cards())
 
     def network_cards_list(self) -> list:
-        """List of NICs for the instance."""
-        return [NetworkCardInfo(nic) for nic in self.network_cards() if nic.get("NetworkCardIndex") is not None]
+        """List of NICs for the instance, sorted by NetworkCardIndex."""
+        cards = [NetworkCardInfo(nic) for nic in self.network_cards() if nic.get("NetworkCardIndex") is not None]
+        cards.sort(key=lambda c: c.network_card_index())
+        return cards
 
     def default_threads_per_core(self):
         """Return the default threads per core for the given instance type."""
@@ -325,6 +327,18 @@ class InstanceTypeInfo:
         """Return the amount of memory in MiB."""
         return self.instance_type_data.get("MemoryInfo", {}).get("SizeInMiB")
 
+    def max_efa_interfaces(self) -> int:
+        """Return the maximum number of EFA interfaces for the instance.
+
+        If EfaInfo/MaximumEfaInterfaces is not present in the API response (older API versions),
+        fall back to 1 if EfaSupported is true, 0 otherwise.
+        """
+        efa_info = self.instance_type_data.get("NetworkInfo", {}).get("EfaInfo", {})
+        max_efa = efa_info.get("MaximumEfaInterfaces")
+        if max_efa is not None:
+            return max_efa
+        return 1 if self.is_efa_supported() else 0
+
 
 class FsxStorageInfo:
     """Data object wrapping the result of a describe_file_systems and describe_file_caches call."""

{aws_parallelcluster-3.14.2 → aws_parallelcluster-3.15.1}/src/pcluster/aws/ec2.py

@@ -310,8 +310,10 @@ class Ec2Client(Boto3Client):
         """Return the id of the current official image, for the provided os-architecture combination."""
         owner = filters.owner if filters and filters.owner else "amazon"
         tags = filters.tags if filters and filters.tags else []
+        name_prefix = filters.name_prefix if filters and filters.name_prefix else ""
+        name = name_prefix + "{0}*".format(self._get_official_image_name_prefix(os, architecture))
 
-        filters = [{"Name": "name", "Values": ["{0}*".format(self._get_official_image_name_prefix(os, architecture))]}]
+        filters = [{"Name": "name", "Values": [name]}]
         filters.extend([{"Name": f"tag:{tag.key}", "Values": [tag.value]} for tag in tags])
         images = self._describe_images_with_pagination(Owners=[owner], Filters=filters, IncludeDeprecated=True)
         if not images:
@@ -568,7 +570,9 @@ class Ec2Client(Boto3Client):
                 raise Exception(f"No subnet found with ID {subnet_id}")
             vpc_id = subnets[0].get("VpcId")
 
-            route_tables = self.describe_route_tables(filters=[{"Name": "vpc-id", "Values": [vpc_id]}])
+            route_tables = self.describe_route_tables(
+                filters=[{"Name": "vpc-id", "Values": [vpc_id]}, {"Name": "association.main", "Values": ["true"]}]
+            )
             if not route_tables:
                 raise Exception("No route tables found. The subnet or VPC configuration may be incorrect.")
 
@@ -679,3 +683,28 @@ class Ec2Client(Boto3Client):
                 reservation_type = reservation.reservation_type()
 
         return instance_type, reservation_type
+
+    @AWSExceptionHandler.handle_client_exception
+    @Cache.cached
+    def describe_launch_template_version(self, launch_template_id: str, version: str):
+        """
+        Describe a launch template version and return its data.
+
+        Args:
+            launch_template_id: The launch template ID (e.g., 'lt-0abc123def456')
+            version: The version number or '$Default'/'$Latest'
+
+        Returns:
+            dict: The LaunchTemplateData from the specified version
+        """
+        response = self._client.describe_launch_template_versions(
+            LaunchTemplateId=launch_template_id,
+            Versions=[version],
+        )
+        versions = response.get("LaunchTemplateVersions", [])
+        if versions:
+            return versions[0].get("LaunchTemplateData", {})
+        raise AWSClientError(
+            function_name="describe_launch_template_versions",
+            message=f"Launch template {launch_template_id} version {version} not found",
+        )

{aws_parallelcluster-3.14.2 → aws_parallelcluster-3.15.1}/src/pcluster/aws/s3.py

@@ -39,14 +39,17 @@ class S3Client(Boto3Client):
                 error_code=client_error.response["Error"]["Code"],
             )
 
-    def head_bucket(self, bucket_name):
+    def head_bucket(self, bucket_name, expected_bucket_owner=None):
         """Retrieve metadata for a bucket without returning the object itself."""
         try:
-            return self._client.head_bucket(Bucket=bucket_name)
+            if expected_bucket_owner:
+                return self._client.head_bucket(Bucket=bucket_name, ExpectedBucketOwner=expected_bucket_owner)
+            else:
+                return self._client.head_bucket(Bucket=bucket_name)
         except ClientError as client_error:
             raise AWSClientError(
                 function_name="head_bucket",
-                message=_process_s3_bucket_error(client_error, bucket_name),
+                message=_process_s3_bucket_error(client_error, bucket_name, expected_bucket_owner),
                 error_code=client_error.response["Error"]["Code"],
             )
 
@@ -150,6 +153,11 @@ def _process_s3_bucket_error(client_error, bucket_name, expected_bucket_owner=No
             f"Failed when accessing object '{object_name}' from bucket '{bucket_name}'. This can be due to "
             f"bucket owner not matching the expected one '{expected_bucket_owner}'"
         )
+    elif expected_bucket_owner and error_code == "403" and error_message == "Forbidden":
+        message = (
+            f"Failed in accessing bucket '{bucket_name}'. This can be due to "
+            f"bucket owner not matching the expected one '{expected_bucket_owner}'"
+        )
     elif object_name and error_code == "404" and error_message == "Not Found":
         message = (
             f"Failed when accessing object '{object_name}' from bucket '{bucket_name}'. This can be due to "

{aws_parallelcluster-3.14.2 → aws_parallelcluster-3.15.1}/src/pcluster/cli/commands/configure/easyconfig.py

@@ -177,9 +177,9 @@ def configure(args):  # noqa: C901
     for queue_index in range(number_of_queues):
         while True:
             queue_name = prompt(
-                f"Name of queue {queue_index+1}",
+                f"Name of queue {queue_index + 1}",
                 validator=lambda x: len(NameValidator().execute(x)) == 0,
-                default_value=f"queue{queue_index+1}",
+                default_value=f"queue{queue_index + 1}",
             )
             if queue_name not in queue_names:
                 break
@@ -208,7 +208,7 @@ def configure(args):  # noqa: C901
             if scheduler != "awsbatch":
                 while True:
                     compute_instance_type = prompt(
-                        f"Compute instance type for compute resource {compute_resource_index+1} in {queue_name}",
+                        f"Compute instance type for compute resource {compute_resource_index + 1} in {queue_name}",
                         validator=lambda x: x in AWSApi.instance().ec2.list_instance_types(),
                         default_value=default_instance_type,
                     )

{aws_parallelcluster-3.14.2 → aws_parallelcluster-3.15.1}/src/pcluster/cli/commands/ssh.py

@@ -79,15 +79,13 @@ class SshCommand(CliCommand):
         "Run ssh command with the cluster username and IP address pre-populated. "
         "Arbitrary arguments are appended to the end of the ssh command."
     )
-    epilog = textwrap.dedent(
-        """Example:
+    epilog = textwrap.dedent("""Example:
 
   pcluster ssh --cluster-name mycluster -i ~/.ssh/id_rsa
 
 Returns an ssh command with the cluster username and IP address pre-populated:
 
-  ssh ec2-user@1.1.1.1 -i ~/.ssh/id_rsa"""
-    )
+  ssh ec2-user@1.1.1.1 -i ~/.ssh/id_rsa""")
 
     def __init__(self, subparsers):
         super().__init__(

{aws_parallelcluster-3.14.2 → aws_parallelcluster-3.15.1}/src/pcluster/cli/model.py

@@ -20,12 +20,6 @@ from pcluster.api import encoder, openapi
 from pcluster.cli.exceptions import APIOperationException
 from pcluster.utils import to_kebab_case, to_snake_case, yaml_load
 
-# For importing package resources
-try:
-    import importlib.resources as pkg_resources  # pylint: disable=ungrouped-imports # nosem
-except ImportError:
-    import importlib_resources as pkg_resources
-
 
 def _param_overrides(operation, param):
     """Provide updates to the model that are specific to the CLI."""
@@ -88,7 +82,7 @@ def _resolve_body(spec, operation):
 
 def package_spec():
     """Load the OpenAPI specification from the package."""
-    with pkg_resources.open_text(openapi, "openapi.yaml") as spec_file:  # pylint: disable=deprecated-method
+    with importlib.resources.open_text(openapi, "openapi.yaml") as spec_file:  # pylint: disable=deprecated-method
         return yaml_load(spec_file.read())
 
 

{aws_parallelcluster-3.14.2 → aws_parallelcluster-3.15.1}/src/pcluster/config/cluster_config.py

@@ -188,9 +188,9 @@ from pcluster.validators.instances_validators import (
     InstancesEFAValidator,
     InstancesMemorySchedulingWarningValidator,
     InstancesNetworkingValidator,
+    LaunchTemplateValidator,
 )
 from pcluster.validators.kms_validators import KmsKeyIdEncryptedValidator, KmsKeyValidator
-from pcluster.validators.login_nodes_validators import LoginNodesSshKeyNameDeprecatedValidator
 from pcluster.validators.monitoring_validators import DetailedMonitoringValidator, LogRotationValidator
 from pcluster.validators.networking_validators import (
     ElasticIpValidator,
@@ -842,25 +842,14 @@ class HeadNodeSsh(_BaseSsh):
         self.allowed_ips = Resource.init_param(allowed_ips, default=CIDR_ALL_IPS)
 
 
-class LoginNodesSsh(_BaseSsh):
+class LoginNodesSsh(Resource):
     """Represent the SSH configuration for LoginNodes."""
 
     def __init__(self, allowed_ips: str = None, **kwargs):
-        key_name_explicitly_set = kwargs.pop("key_name_explicitly_set", False)
         super().__init__(**kwargs)
         # If AllowedIPs is not specified for the login node pool, then allowed_ips will default to the same settings
         # in the HeadNode to restrict SSH access from a specific CIDR or prefix-list.
         self.allowed_ips = Resource.init_param(allowed_ips)
-        # Track whether the key_name was explicitly set in the configuration.
-        self._key_name_explicitly_set = key_name_explicitly_set
-
-    def _register_validators(self, context=None):
-        super()._register_validators(context)
-        self._register_validator(
-            LoginNodesSshKeyNameDeprecatedValidator,
-            key_name=self.key_name,
-            key_name_explicitly_set=self._key_name_explicitly_set,
-        )
 
 
 class SharedStorageEfsSettings(Resource):
@@ -890,6 +879,15 @@ class Efa(Resource):
         self.gdr_support = Resource.init_param(gdr_support, default=False)
 
 
+class LaunchTemplateOverrides(Resource):
+    """Represent the Launch Template Overrides configuration."""
+
+    def __init__(self, launch_template_id: str = None, version: int = None, **kwargs):
+        super().__init__(**kwargs)
+        self.launch_template_id = Resource.init_param(launch_template_id)
+        self.version = Resource.init_param(version)
+
+
 # ---------------------- Health Checks ---------------------- #
 
 
@@ -1199,10 +1197,11 @@ class AdditionalPackages(Resource):
 class AmiSearchFilters(Resource):
     """Represent the configuration for AMI search filters."""
 
-    def __init__(self, tags: List[Tag] = None, owner: str = None):
+    def __init__(self, tags: List[Tag] = None, owner: str = None, name_prefix: str = None):
         super().__init__()
         self.tags = tags
         self.owner = owner
+        self.name_prefix = name_prefix
 
 
 class Timeouts(Resource):
@@ -1237,6 +1236,7 @@ class ClusterDevSettings(BaseDevSettings):
         instance_types_data: str = None,
         timeouts: Timeouts = None,
         compute_startup_time_metric_enabled: bool = None,
+        efa_interface_type: str = None,
         **kwargs,
     ):
         super().__init__(**kwargs)
@@ -1247,6 +1247,7 @@ class ClusterDevSettings(BaseDevSettings):
         self.compute_startup_time_metric_enabled = Resource.init_param(
             compute_startup_time_metric_enabled, default=False
         )
+        self.efa_interface_type = Resource.init_param(efa_interface_type)
 
     def _register_validators(self, context: ValidatorContext = None):
         super()._register_validators(context)
@@ -2239,6 +2240,7 @@ class _BaseSlurmComputeResource(BaseComputeResource):
         tags: List[Tag] = None,
         static_node_priority: int = None,
         dynamic_node_priority: int = None,
+        launch_template_overrides: LaunchTemplateOverrides = None,
         **kwargs,
     ):
         super().__init__(**kwargs)
@@ -2259,6 +2261,7 @@ class _BaseSlurmComputeResource(BaseComputeResource):
         self.tags = tags
         self.static_node_priority = Resource.init_param(static_node_priority, default=1)
         self.dynamic_node_priority = Resource.init_param(dynamic_node_priority, default=1000)
+        self.launch_template_overrides = launch_template_overrides
 
     @abstractmethod
     def is_flexible(self) -> bool:
@@ -2303,6 +2306,11 @@ class _BaseSlurmComputeResource(BaseComputeResource):
     def max_network_cards(self) -> int:
         """Return max number of NICs for the instance."""
 
+    @property
+    @abstractmethod
+    def max_efa_interfaces(self) -> int:
+        """Return max number of EFA interfaces for the instance."""
+
     @property
     @abstractmethod
     def network_cards_list(self) -> list:
@@ -2361,6 +2369,13 @@ class SlurmFlexibleComputeResource(_BaseSlurmComputeResource):
             ec2memory=min_memory,
             instance_type=smallest_type,
         )
+        if self.launch_template_overrides:
+            self._register_validator(
+                LaunchTemplateValidator,
+                compute_resource_name=self.name,
+                launch_template_id=self.launch_template_overrides.launch_template_id,
+                launch_template_version=self.launch_template_overrides.version,
+            )
 
     def is_flexible(self):
         """Return True because the ComputeResource can contain multiple instance types."""
@@ -2387,6 +2402,11 @@ class SlurmFlexibleComputeResource(_BaseSlurmComputeResource):
                 least_max_nics = min(least_max_nics, max_nics)
         return least_max_nics
 
+    @property
+    def max_efa_interfaces(self) -> int:
+        """Return max number of EFA interfaces for the compute resource."""
+        return min(self.instance_type_info_map[it].max_efa_interfaces() for it in self.instance_types)
+
     @property
     def network_cards_list(self) -> list:
         """Return the list of NIC indexes for the compute resource.
@@ -2448,6 +2468,13 @@ class SlurmComputeResource(_BaseSlurmComputeResource):
             ec2memory=self._instance_type_info.ec2memory_size_in_mib(),
             instance_type=self.instance_type,
         )
+        if self.launch_template_overrides:
+            self._register_validator(
+                LaunchTemplateValidator,
+                compute_resource_name=self.name,
+                launch_template_id=self.launch_template_overrides.launch_template_id,
+                launch_template_version=self.launch_template_overrides.version,
+            )
 
     @property
     def architecture(self) -> str:
@@ -2464,6 +2491,11 @@ class SlurmComputeResource(_BaseSlurmComputeResource):
         """Return max number of NICs for the instance."""
         return self._instance_type_info.max_network_cards()
 
+    @property
+    def max_efa_interfaces(self) -> int:
+        """Return max number of EFA interfaces for the instance."""
+        return self._instance_type_info.max_efa_interfaces()
+
     @property
     def network_cards_list(self) -> list:
         """List of NIC indexes for the instance."""
@@ -2706,6 +2738,7 @@ class SlurmQueue(_CommonQueue):
                 is False,
                 multi_az_enabled=self.multi_az_enabled,
                 capacity_type=self.capacity_type,
+                queue_name=self.name,
             )
             self._register_validator(
                 ComputeResourceSizeValidator,
@@ -2936,16 +2969,9 @@ class SlurmClusterConfig(BaseClusterConfig):
             # Create a LocalStorage for the LoginNodesPool and ensure that encrypted = true
             for pool in self.login_nodes.pools:
                 pool.local_storage = LocalStorage(implied=True)
-                # If there's no customer ssh key for LoginNodes pool, set a default value as HeadNode's ssh key
-                if pool.ssh and not pool.ssh.key_name:
-                    pool.ssh.key_name = self.head_node.ssh.key_name
-                    # Mark that this key was not explicitly set by the user
-                    pool.ssh._key_name_explicitly_set = False
-                elif not pool.ssh:
-                    pool.ssh = LoginNodesSsh(key_name=self.head_node.ssh.key_name, key_name_explicitly_set=False)
-                else:
-                    # SSH config exists and has a key_name, mark it as explicitly set
-                    pool.ssh._key_name_explicitly_set = True
+                # If the login node pool SSH config is not specified, create one
+                if not pool.ssh:
+                    pool.ssh = LoginNodesSsh()
                 # If the login node pool allowed IPs is not specified, forces the source allowed IP for the
                 # SSH connection to the one defined in the HeadNode
                 if not pool.ssh.allowed_ips:
@@ -3211,7 +3237,6 @@ class SlurmClusterConfig(BaseClusterConfig):
                         subnet=queue.networking.subnet_ids[0],
                         instance_types=compute_resource.instance_types,
                         multi_az_enabled=queue.multi_az_enabled,
-                        subnet_id_az_mapping=queue.networking.subnet_id_az_mapping,
                     )
                 for instance_type in compute_resource.instance_types:
                     if self.scheduling.settings.enable_memory_based_scheduling:

{aws_parallelcluster-3.14.2 → aws_parallelcluster-3.15.1}/src/pcluster/config/update_policy.py

@@ -11,6 +11,7 @@
 import re
 from enum import Enum
 
+from pcluster.aws.common import get_region
 from pcluster.config.cluster_config import QueueUpdateStrategy
 from pcluster.config.update_policy_utils import SharedStorageChangeInfo
 from pcluster.constants import (
@@ -20,6 +21,7 @@ from pcluster.constants import (
     SLURM,
     STORAGE_TYPES_SUPPORTING_LIVE_UPDATES,
 )
+from pcluster.utils import get_dictionary_diff, parse_json_string
 
 
 class UpdatePolicy:
@@ -148,6 +150,12 @@ def is_slurm_queues_change(change):
     return any(path.startswith("SlurmQueues[") for path in change.path)
 
 
+def _is_adc_region():
+    """Return True if the currently configured AWS region belongs to an ADC partition."""
+    region = get_region() or ""
+    return region.startswith("us-iso")
+
+
 def extract_type_and_name_from_path(path):
     # Example path = 'SlurmQueues[slurm-q-name]'
     # This function returns the type and name extracted like this: 'SlurmQueues', 'slurm-q-name'
@@ -510,6 +518,40 @@ def get_pool_name_from_change_paths(change):
     return ""
 
 
+# ExtraChefAttributes update policy helpers
+# Define which paths within ExtraChefAttributes JSON are updatable (dot-notation)
+# IMPORTANT: We assume this set to contain the path to leaf fields.
+EXTRA_CHEF_ATTRIBUTES_UPDATABLE_PATHS: set[str] = {
+    "cluster.slurm.reconfigure_timeout",
+    "cluster.cluster_readiness_check_enabled",
+    "cluster.cluster_readiness_check_ignore_failure",
+}
+
+
+def _get_non_updatable_changes(old_value: str, new_value: str) -> list[str]:
+    """Parse and compare two ExtraChefAttributes JSON strings, returning paths that are not updatable."""
+    old_attrs = parse_json_string(old_value, raise_on_error=False, default={}) if old_value else {}
+    new_attrs = parse_json_string(new_value, raise_on_error=False, default={}) if new_value else {}
+
+    return [p for p in get_dictionary_diff(old_attrs, new_attrs) if p not in EXTRA_CHEF_ATTRIBUTES_UPDATABLE_PATHS]
+
+
+def condition_checker_extra_chef_attributes(change, _) -> bool:
+    """
+    Check if ExtraChefAttributes changes are allowed.
+
+    Only changes to paths defined in EXTRA_CHEF_ATTRIBUTES_UPDATABLE_PATHS are allowed.
+    """
+    return len(_get_non_updatable_changes(change.old_value, change.new_value)) == 0
+
+
+def fail_reason_extra_chef_attributes(change, _) -> str:
+    """Generate fail reason for ExtraChefAttributes update."""
+    non_updatable_changes = _get_non_updatable_changes(change.old_value, change.new_value)
+    paths_str = ", ".join(sorted(non_updatable_changes))
+    return f"The following ExtraChefAttributes fields cannot be updated: {paths_str}"
+
+
 # Common fail_reason messages
 UpdatePolicy.FAIL_REASONS = {
     "ebs_volume_resize": "Updating the file system after a resize operation requires commands specific to your "
@@ -526,6 +568,7 @@ UpdatePolicy.FAIL_REASONS = {
     "compute_or_login_nodes_running": lambda change, patch: (
         "The update is not supported when compute or login nodes are running"
     ),
+    "extra_chef_attributes_update": fail_reason_extra_chef_attributes,
 }
 
 # Common action_needed messages
@@ -548,6 +591,9 @@ UpdatePolicy.ACTIONS_NEEDED = {
         "Stop the login nodes by setting Count parameter to 0 "
         "and update the cluster with the pcluster update-cluster command"
     ),
+    "extra_chef_attributes_update": lambda change, patch: (
+        "Revert the non-updatable ExtraChefAttributes fields to their original values."
+    ),
 }
 
 # Base policies
@@ -567,6 +613,15 @@ UpdatePolicy.SUPPORTED = UpdatePolicy(
     name="SUPPORTED", level=0, fail_reason="-", condition_checker=(lambda change, patch: True)
 )
 
+# Update policy for ExtraChefAttributes - allows updates to specific fields only
+UpdatePolicy.EXTRA_CHEF_ATTRIBUTES = UpdatePolicy(
+    name="EXTRA_CHEF_ATTRIBUTES",
+    level=5,
+    fail_reason=UpdatePolicy.FAIL_REASONS["extra_chef_attributes_update"],
+    action_needed=UpdatePolicy.ACTIONS_NEEDED["extra_chef_attributes_update"],
+    condition_checker=condition_checker_extra_chef_attributes,
+)
+
 # Checks resize of max_vcpus in Batch Compute Environment
 UpdatePolicy.AWSBATCH_CE_MAX_RESIZE = UpdatePolicy(
     name="AWSBATCH_CE_MAX_RESIZE",
@@ -682,6 +737,25 @@ UpdatePolicy.UNSUPPORTED = UpdatePolicy(
     + ". If you need this change, please consider creating a new cluster instead of updating the existing one.",
 )
 
+# Update supported everywhere except ADC regions (us-iso*, us-isob*).
+#
+# In ADC regions there is a CloudFormation behavior where an UpdateStack call that includes
+# both a Tags change and a resource whose change is only in Metadata does not update that
+# resource. This breaks the head node update flow because cfn-hup on the head node polls
+# DescribeStackResource for Metadata changes on HeadNodeLaunchTemplate and never sees them,
+# leaving the HeadNodeWaitCondition to time out.
+#
+# Until the CloudFormation behavior is fixed in ADC, block tag updates in those regions.
+UpdatePolicy.SUPPORTED_UNLESS_ADC = UpdatePolicy(
+    name="SUPPORTED_UNLESS_ADC",
+    level=1000,
+    fail_reason=lambda change, patch: (
+        f"Updating '{change.key}' during a cluster update is not supported in ADC regions."
+    ),
+    action_needed=lambda change, patch: f"Restore '{change.key}' to its previous value.",
+    condition_checker=lambda change, patch: not _is_adc_region(),
+)
+
 # Block update if cluster has a managed Fsx for Lustre FileSystem, otherwise fallback to QueueUpdateStrategy
 UpdatePolicy.MANAGED_FSX = UpdatePolicy(
     name="MANAGED_FSX",