kishorj
commented
1 year ago @jralph, controller doesn't manage the ingress SG rules by default if you manually specify the SGs via alb.ingress.kubernetes.io/security-groups annotation. If you want the controller to manage backend rules with the security-groups annotation, then you'd need to specify the annotation alb.ingress.kubernetes.io/manage-backend-security-group-rules: "true", for further details, please refer to the live docs https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/ingress/annotations/#manage-backend-security-group-rules
ghost
k8s-triage-robot
oliviassss
Describe the bug When the annotation
alb.ingress.kubernetes.io/security-groupsis used to attach your own security group to the alb, the shared backend security group is not added, causing all traffic to be blocked by the node/pod security group.Steps to reproduce Deploy an ingress with a custom security group using the
alb.ingress.kubernetes.io/security-groupsannotation, along with nodes that are private.We're running an eks cluster with vpc cni networking, and the
alb.ingress.kubernetes.io/target-typeannotation set toip.Expected outcome The shared backend security group should always be added, even when the
alb.ingress.kubernetes.io/security-groupsannotation is used.Optionally, there could be another annotation to disable this, although I'd guess that use case would be pretty rare. Why would you want an alb that is unable to talk to the backend pods/nodes?
Environment
Additional Context: When trying to add a custom security group to only allow connections to our alb from the CoudFront prefix list, we encountered this issue.