aws / aws/containers-roadmap

[EKS] [request]: When EKS deletes ELB(service/ingress) it doesnt delete the SG if its referenced in another SG.

Open
#1,841 0 comments 2 reactions 0 assignees View on GitHub
EKS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
When EKS deletes a ELB(service/ingress), it doesn't delete the Security group created by it if its referenced in another Security group. For clarification, the reference rule is created in another Security Group automatically when the ingress/service is deployed. Additionally, the cloudtrail is populated with "Client.DependencyViolation" until you delete the rule.

This leads to unnecessary security group retention. Over time there will be so many Security groups created that it becomes to hard to manage them. This also leading to submitting limit increase requests for Security groups.

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
EKS team should implement a mechanism in which the clean up process is seamless. Running "kubectl delete .yaml" should clean up the Security group even if there is a reference in another Security group by removing the rule.

**Are you currently working around this issue?**
Currently, the security groups are being deleted through console but also team is looking into using "service.beta.kubernetes.io/aws-load-balancer-security-groups" annotation to prevent the creation of unnecessary security groups.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the EKS service or ingress deletion described in the issue and review the resulting security-group rules and CloudTrail DependencyViolation events. Compare cleanup with the aws-load-balancer-security-groups annotation; the work is done when deletion removes the generated security group and any dependent rule without manual console cleanup.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
cloud, infrastructure, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.