You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
And if the node is using a custom network, the vpc resource controller uses ENIConfig's spec.securityGroups for trunk ENI. However, if this is not specified on ENIConfig, the default security group for VPC will be used as specification for the CreateNetworkInterface API. This differs in behavior from the following specifications.
@hiraken-w thanks for submitting this issue. We should fail the request if the security groups are missing in eniConfig, or doing what you said as the doc describes to use instance SG. Let me discuss with our CNI team and make a change accordingly since this is supporting custom networking feature.
Describe the Bug:
I verified this behavior using the following version.
1.25
eks.1
v1.12.2
When trunk ENI is created, the attaching security groups are chosen based on whether the node is using custom network.
amazon-vpc-resource-controller-k8s/pkg/aws/ec2/instance.go
Lines 238 to 258 in f45d019
And if the node is using a custom network, the vpc resource controller uses ENIConfig's spec.securityGroups for trunk ENI. However, if this is not specified on ENIConfig, the default security group for VPC will be used as specification for the CreateNetworkInterface API. This differs in behavior from the following specifications.
https://github.com/awsdocs/amazon-eks-user-guide/blob/086ca837b806e2fe73702f2cc1c827c677207ebb/doc_source/cni-custom-network.md?plain=1#L293-L296
If no security group is specified on ENIConfig, I believe that the primary ENI's security group should also be used for trunk ENI.
Observed Behavior:
If a custom network is used and no security group is specified on ENIConfig, the VPC default security group is attached to the trunk ENI
Expected Behavior:
The primary ENI's security groups are used for trunk ENI
How to reproduce it (as minimally and precisely as possible):
Create a new node.
Check the trunk ENI's security group.
Additional Context:
none.
Environment:
kubectl version
): 1.25.6The text was updated successfully, but these errors were encountered: