[EKS] [request]: When Kubernetes deletes a service and its associated ELB, it deletes the shared security groups on the ELB
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
When a Kubernetes service is deleted, EKS deletes the ELB associated with that service. In our case, the ELB has a shared security group applied on it, which is an inbound security group rule for other security groups. When the ELB is deleted, EKS deletes the shared security group as well, removing the inbound rule on other security groups and disrupts communication in our cluster.
EKS should not delete security groups it did not create, it should disassociate them. EKS should only delete security groups that it itself has created.
**Which service(s) is this request for?**
EKS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
EKS should not delete security groups from ELBs it did not create. This action is taken automatically from EKS when deleting a Kubernetes service, and we have no control to change it.
**Are you currently working around this issue?**
We can no longer delete a Kubernetes service directly. We are using a separate flow which involves disassociating the shared security group before deleting the ELB.
Contributor guide
Research direction
The request concerns EKS deleting ELB-associated shared security groups when a Kubernetes service is removed. Start by reviewing the EKS service and ELB deletion behavior and the requirement to disassociate rather than delete shared groups; done would mean EKS removes only security groups it created while preserving shared groups and their inbound rules.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100