kubernetes-sigs / aws-load-balancer-controller

A Kubernetes controller for Elastic Load Balancers
https://kubernetes-sigs.github.io/aws-load-balancer-controller/
Apache License 2.0
3.88k stars 1.44k forks source link

Tags not propagated to shared backend security group #3805

Open SAJLinders opened 1 month ago

SAJLinders commented 1 month ago

Describe the bug When defining tags these are not propagated to the shared backend security group. Regardless of whether the tags are applied on the controller or the Ingress resource directly.

Steps to reproduce

  1. Deploy the AWS Load Balancer Controller with defaultTags configured.
  2. Create a new Ingress resource.
  3. A load balancer is created and attached, with correct tagging.
  4. Observe how the managed security for load balancer security group correctly has the tags added. But the shared backend security group does not.

Expected outcome The default tags to be applied to all created security groups.

Environment

M00nF1sh commented 4 weeks ago

@SAJLinders The shared backend security group is expected to be shared across all Ingresses/Services in an cluster. So individual tags annotation on each Ingress won't be applied. In the meanwhile, the default-tags set via controller commandLine flags will be set on the generated backend security group. However, currently it only happens when the backend security group is created.(i.e. if you already have any ingress/service before you change the default-tags commandLine flags, the shared backend security group must already be generated thus the tags won't be updated). To solve this, you can either manually attach necessary tags to the shared backend security group or use a new cluster and specify default-tags during installation of this controller.

/kind feature I think we should change our logic so that the default tags updates via default-tags commandLine flags can be continously synced to backend security group(even if it's already created)