EKS Security Groups: Consistent names for EKS Security Groups.
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
**Tell us about your request**
What do you want us to build? - There are 3 security groups that are part of an EKS Cluster, but the AWS documentation has it named differently in different parts of the documentation, I would like the naming to be consistent across the documentation, and in the AWS console.
**Which service(s) is this request for?**
EKS
Elastic Kubernetes Service
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
1) "Amazon EKS security group considerations" - https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html describes recommended or minimum required security group settings for the cluster, control plane, and node security groups of EKS cluster, below are the security groups.
a) Cluster security group
b) Control plane security group and
c) Node security group.
My questions are.
i) Why is Control plane security group also called as additional security group in the documentation and in the EKS Console? Or, why does a single security group have 2 names? " (Control plane security group is called as "Additional Security group" in the console.
ii) Why is Cluster security group not called as Managed node security group? "A cluster security group is designed to allow all traffic from the control plane and managed node groups to flow freely between each other. "
iii) Why is Node security group not called as self-managed node security group?
2) When launching self-managed nodes from document - https://docs.aws.amazon.com/eks/latest/userguide/launch-workers.html it dictates to use ClusterControlPlaneSecurityGroup from the Cloudformation console resources when the cluster was created. This is confusing to have cluster and control plane infront of security group and not sure which one to pick. Here, we have to pick the Additional security group.
What outcome are you trying to achieve, ultimately, and why is it hard/impossible to do right now? What is the impact of not having this problem solved? The more details you can provide, the better we'll be able to understand and solve the problem.
If I were to create self-managed nodes, I would like to navigate to EKS console or Cloudformation and have same name for any of the security groups.
Or if I am troubleshooting an issues, I would like to have everyone in my team or AWS Support say the same name for security group and prevent any confusions.
**Are you currently working around this issue?**
N/A
**Additional context**
Anything else we should know?
To my understanding, the order of security groups in the documentation has to be changed. First, Control plane security group, cluster security group, and then node security group.
**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)
Contributor guide
Research direction
Compare the terminology in the EKS security group considerations and launch-workers documentation with the names shown in the EKS and CloudFormation consoles. Determine the agreed names and ordering for cluster, control plane/additional, and node security groups; done means the terminology is consistent across the referenced documentation and console surfaces.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- cloud, documentation
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100