[EKS][Feature Request]: Support AWS Managed Prefix Lists in EKS Auto Mode IngressClassParams
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
# Summary
Add support for AWS Managed Prefix Lists in EKS Auto Mode IngressClassParams (`apiVersion: eks.amazonaws.com/v1`) to enable centralized configuration of ALB inbound access rules at the IngressClass level.
---
# Problem Statement
Currently, EKS Auto Mode does not support configuring AWS Managed Prefix Lists through IngressClassParams.
The open-source AWS Load Balancer Controller supports centralized prefix list configuration through IngressClassParams, allowing ALB security group inbound rules to reference Managed Prefix Lists instead of maintaining large static CIDR ranges.
However, the EKS Auto Mode IngressClassParams CRD does not expose an equivalent field for prefix list configuration.
The only currently supported workaround is using the following per-Ingress annotation:
```yaml id="8q2lwv"
alb.ingress.kubernetes.io/security-group-prefix-lists
```
This approach introduces several operational challenges:
* The current annotation-based approach requires configuration to be managed at the Ingress resource level instead of centrally through IngressClassParams, which creates operational and governance challenges for platform teams.
* Increased risk of configuration drift
* Reduced governance and standardization
* Higher operational overhead for platform teams
* Difficulties managing externally maintained IP ranges that change over time
Our platform team requires centralized management of ALB network access policies through IngressClassParams rather than application-level annotations.
---
# Use Cases
* Centrally managing inbound ALB access rules across multiple applications
* Using AWS Managed Prefix Lists for third-party network ranges that auto-update
* Reducing operational overhead caused by maintaining large CIDR lists
* Enforcing platform governance and standardization
* Avoiding repeated per-Ingress annotations across environments and clusters
* Supporting enterprise platform engineering models where networking policies are controlled centrally
---
# Requested Feature
Add support for Managed Prefix Lists in the EKS Auto Mode IngressClassParams CRD (`apiVersion: eks.amazonaws.com/v1`).
Example expectation:
```yaml id="y6j3tk"
apiVersion: eks.amazonaws.com/v1
kind: IngressClassParams
metadata:
name: example
spec:
prefixListsIDs:
- pl-xxxxxxxx
- pl-yyyyyyyy
```
Expected behavior:
* ALB security group inbound rules should reference AWS Managed Prefix Lists
* Configuration should apply centrally at the IngressClass level
* No per-Ingress annotations should be required
* Behavior should align with the functionality available in the open-source AWS Load Balancer Controller
---
# References
### EKS Auto Mode ALB configuration documentation
https://docs.aws.amazon.com/eks/latest/userguide/auto-configure-alb.html#_considerations
### AWS Load Balancer Controller IngressClassParams documentation
https://kubernetes-sigs.github.io/aws-load-balancer-controller/v3.3/guide/ingress/ingress_class/
Contributor guide
Research direction
Start with the linked EKS Auto Mode ALB configuration documentation and AWS Load Balancer Controller IngressClassParams documentation, then compare their prefix-list capabilities with the requested eks.amazonaws.com/v1 CRD field. Done means Managed Prefix Lists can be configured centrally through IngressClassParams and ALB inbound rules use them without per-Ingress annotations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 38/100