search

kubernetes-sigs / cluster-api-provider-aws

Kubernetes Cluster API Provider AWS provides consistent deployment and day 2 operations of "self-managed" and EKS Kubernetes clusters on AWS.
http://cluster-api-aws.sigs.k8s.io/
Apache License 2.0
636 stars 561 forks source link

Security group rule "Node Port Services" can be more restrictive #3314

Open vincepri opened 2 years ago

vincepri commented 2 years ago

When creating a new AWSCluster, part of the infrastructure is creating Security Groups for machines to use.

Currently, the Node Port Services security group allows access from any IP. Should we consider making this bit configurable to a set of pre-defined CIDR blocks, or allow the VPC CIDR's by default?

https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/0eee2776780168fa4dd3f2edffdb9f3d614973a3/pkg/cloud/services/securitygroup/securitygroups.go#L525-L531

/area security /kind bug /assign @sedefsavas

sedefsavas commented 2 years ago

Yes, very good point. SGs are opinionated and not very flexible other than supporting BYO SGs. Modifying existing SGs are not supported. Need to go through a refactoring, tracked here https://github.com/kubernetes-sigs/cluster-api-provider-aws/issues/392

Allowing only VPC CIDR by default will break some use cases (like peered VPC) without the flexibility to modify. So will address this as part of #392.

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

rymancl commented 2 years ago

/remove-lifecycle stale

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

rymancl commented 2 years ago

/remove-lifecycle stale

k8s-triage-robot commented 1 year ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

rymancl commented 1 year ago

/remove-lifecycle stale

dlipovetsky commented 1 year ago

From office hours 01/23/23: Work on #392 is underway. Once CAPA supports customizing security groups, we can cover this specific use case in documentation.

/triage accepted /priority import-longterm

k8s-ci-robot commented 1 year ago

@dlipovetsky: The label(s) priority/import-longterm cannot be applied, because the repository doesn't have them.

In response to [this](https://github.com/kubernetes-sigs/cluster-api-provider-aws/issues/3314#issuecomment-1400735923): >From office hours 01/23/23: Work on #392 is underway. Once CAPA supports customizing security groups, we can cover this specific use case in documentation. > >/triage accepted >/priority import-longterm Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
Skarlso commented 1 year ago

/priority important-longterm

Skarlso commented 1 year ago

/priority important-longterm

k8s-triage-robot commented 8 months ago

This issue has not been updated in over 1 year, and should be re-triaged.

You can:

For more details on the triage process, see https://www.kubernetes.dev/docs/guide/issue-triage/

/remove-triage accepted

k8s-triage-robot commented 5 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 4 months ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

krasoffski commented 1 day ago

Hi, I just added solution when we can specify CIDR blocks instead of default 0.0.0.0/0. Any comments or ideas are very appreciated.