-
Notifications
You must be signed in to change notification settings - Fork 300
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support managing multiple tagged security groups for a node #666
Comments
@cartermckinnon do you have any thoughts on this one? |
cc. @dims |
I don't think there is any technical issue for having more than one tagged security groups as far as i can tell. This code was added long back when SG's were enabled which used to be a warning but latest got changed to error with the reason mentioned as comment for the function . So, i think its mostly security related than any limitation. Can you please describe your use case a bit more in detail on why/how the instance would have multiple SG with tags? |
Sure @kmala. When one of those workers get attached to the Load Balancer, the LB security group rules are propagated by the CCM to the tagged Security Group attached to the worker instance. Here though, in our case, we have multiple security groups, but since the CCM only considers one SG with the tag, the rule changes get propagated only to that (SG1), and not also to the other SGs attached (SG2,..., SGx). This causes traffic issues. |
/triage accepted |
@kmala: The label In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Sounds good. I think we can add support for this. |
/triage accepted sounds legit to me! |
Great! Thanks @kmala & @cartermckinnon |
What would you like to be added:
Add support for managing multiple tagged security groups for a node.
Why is this needed:
At the moment we don't support finding and managing multiple tagged SecurityGroups per node (only one), and when we find more than one we error (ref code here).
As such if a node has 2 or more tagged SecurityGroups we would fail to modify them in order to allow inbound traffic from the LB SecurityGroup.
Is there anything preventing us to extend this functionality to more than one tagged SecurityGroup?
If not, would it be possible to consider implementing it?
Thanks
/kind feature
The text was updated successfully, but these errors were encountered: