search

kubernetes-sigs / aws-load-balancer-controller

A Kubernetes controller for Elastic Load Balancers
https://kubernetes-sigs.github.io/aws-load-balancer-controller/
Apache License 2.0
3.91k stars 1.45k forks source link

Inconsistency across docs/code for aws-load-balancer-manage-backend-security-group-rules #3660

Open rgs1 opened 5 months ago

rgs1 commented 5 months ago

In the annotations docs it says that aws-load-balancer-manage-backend-security-group-rules defaults to true:

https://github.com/kubernetes-sigs/aws-load-balancer-controller/blame/main/docs/guide/service/annotations.md#L52

[service.beta.kubernetes.io/aws-load-balancer-manage-backend-security-group-rules](#manage-backend-sg-rules)  | boolean    | true

However in the security docs the writing implies that it needs to be explicitly set:

https://github.com/kubernetes-sigs/aws-load-balancer-controller/blame/main/docs/deploy/security_groups.md#L64

- To enable managing backend security group rules, apply an additional annotation to Ingress and Service resources.
  - For Ingress resources, set the `alb.ingress.kubernetes.io/manage-backend-security-group-rules` annotation to `true`.
  - For Service resources, set the `service.beta.kubernetes.io/aws-load-balancer-manage-backend-security-group-rules` annotation to `true`.

To make things consistent we either need to document that the annotation defaults to false or make the default actually true. Making it true by default is probably the desired path for most setups.

rgs1 commented 5 months ago

Ok I see the issue now, it's true by default if aws-load-balancer-security-groups is not set. If aws-load-balancer-security-groups is set, then you must specifically opt in. I'll update the docs to make this more clear.

oliviassss commented 4 months ago

@rgs1, yes your understanding is correct. If the user specifies the self-managed SG through aws-load-balancer-security-groups annotation, the controller by default won't manage the backend sg rules. You can also check here for more details https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.8/deploy/security_groups/

k8s-triage-robot commented 1 month ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 2 weeks ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten