aws / aws/containers-roadmap

[EKS][Feature Request]: Support AWS Managed Prefix Lists in EKS Auto Mode IngressClassParams

Open
#2,822 0 comments 2 reactions 0 assignees View on GitHub
EKS EKS Auto Mode Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

# Summary

Add support for AWS Managed Prefix Lists in EKS Auto Mode IngressClassParams (`apiVersion: eks.amazonaws.com/v1`) to enable centralized configuration of ALB inbound access rules at the IngressClass level.

---

# Problem Statement

Currently, EKS Auto Mode does not support configuring AWS Managed Prefix Lists through IngressClassParams.

The open-source AWS Load Balancer Controller supports centralized prefix list configuration through IngressClassParams, allowing ALB security group inbound rules to reference Managed Prefix Lists instead of maintaining large static CIDR ranges.

However, the EKS Auto Mode IngressClassParams CRD does not expose an equivalent field for prefix list configuration.

The only currently supported workaround is using the following per-Ingress annotation:

```yaml id="8q2lwv"
alb.ingress.kubernetes.io/security-group-prefix-lists
```

This approach introduces several operational challenges:

* The current annotation-based approach requires configuration to be managed at the Ingress resource level instead of centrally through IngressClassParams, which creates operational and governance challenges for platform teams.
* Increased risk of configuration drift
* Reduced governance and standardization
* Higher operational overhead for platform teams
* Difficulties managing externally maintained IP ranges that change over time

Our platform team requires centralized management of ALB network access policies through IngressClassParams rather than application-level annotations.

---

# Use Cases

* Centrally managing inbound ALB access rules across multiple applications
* Using AWS Managed Prefix Lists for third-party network ranges that auto-update
* Reducing operational overhead caused by maintaining large CIDR lists
* Enforcing platform governance and standardization
* Avoiding repeated per-Ingress annotations across environments and clusters
* Supporting enterprise platform engineering models where networking policies are controlled centrally

---

# Requested Feature

Add support for Managed Prefix Lists in the EKS Auto Mode IngressClassParams CRD (`apiVersion: eks.amazonaws.com/v1`).

Example expectation:

```yaml id="y6j3tk"
apiVersion: eks.amazonaws.com/v1
kind: IngressClassParams
metadata:
name: example
spec:
prefixListsIDs:
- pl-xxxxxxxx
- pl-yyyyyyyy
```

Expected behavior:

* ALB security group inbound rules should reference AWS Managed Prefix Lists
* Configuration should apply centrally at the IngressClass level
* No per-Ingress annotations should be required
* Behavior should align with the functionality available in the open-source AWS Load Balancer Controller

---

# References

### EKS Auto Mode ALB configuration documentation

https://docs.aws.amazon.com/eks/latest/userguide/auto-configure-alb.html#_considerations

### AWS Load Balancer Controller IngressClassParams documentation

https://kubernetes-sigs.github.io/aws-load-balancer-controller/v3.3/guide/ingress/ingress_class/

Contributor guide

Open the contributing guide

Research direction

Start with the linked EKS Auto Mode ALB configuration documentation and AWS Load Balancer Controller IngressClassParams documentation, then compare their prefix-list capabilities with the requested eks.amazonaws.com/v1 CRD field. Done means Managed Prefix Lists can be configured centrally through IngressClassParams and ALB inbound rules use them without per-Ingress annotations.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, networking
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.