aws / aws/containers-roadmap

[EKS] [request]: dynamically spread loadBalancerSourceRanges into multiple security groups

Open
#1,151 0 comments 3 reactions 0 assignees View on GitHub
EKS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
When `loadBalancerSourceRanges` is specified on an NLB service, AWS controller needs to able to spread the IP list into multiple security groups if needed

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
When a whitelist IPs in `loadBalancerSourceRanges` is very long, one can easily run into AWS security group rule limits. Since security group and rule limits are per account based, sometimes it is not feasible to just have a big security group for EKS clusters as that will impact other services in that account because that will reduce the number of security group other VPCs can have. AWS controller should allow customer to specify multiple security groups and it should be dynamically spreads the whitelist among those security groups.

**Are you currently working around this issue?**
We reduced the security group to 3 and also increased the security group rules limit to 330; however, that doesn't give us much room to grow.

Contributor guide

Open the contributing guide

Research direction

The issue describes EKS Network Load Balancer services and loadBalancerSourceRanges, but names no repository files, tests, or entry points. Start by locating the AWS controller logic for NLB security groups and its tests; done means distributing the whitelist across customer-specified security groups without exceeding AWS security-group rule limits.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
cloud, networking, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.