Kubernetes and AWS: Set LoadBalancer to use predefined Security Group

Question

As the title says, I am looking for a way to force a LoadBalancer service to use a predefined security group in AWS. I do not want to have to manually edit the inbound/outbound

Answer 1

It looks like this is not currently possible. Via the following code in the api, https://github.com/kubernetes/kubernetes/blob/37b5726716231c13117c4b05a841e00417b92cda/pkg/cloudprovider/providers/aws/aws.go :

func (s *AWSCloud) EnsureLoadBalancer(name, region string, publicIP net.IP, ports []*api.ServicePort, hosts []string, affinity api.ServiceAffinity) (*api.LoadBalancerStatus, error) {
glog.V(2).Infof("EnsureLoadBalancer(%v, %v, %v, %v, %v)", name, region,    publicIP, ports, hosts)

.
.
.

// Create a security group for the load balancer
var securityGroupID string
{
    sgName := "k8s-elb-" + name
    sgDescription := "Security group for Kubernetes ELB " + name
    securityGroupID, err = s.ensureSecurityGroup(sgName, sgDescription, vpcId)
    if err != nil {
        glog.Error("Error creating load balancer security group: ", err)
        return nil, err
    }

    permissions := []*ec2.IpPermission{}
    for _, port := range ports {
        portInt64 := int64(port.Port)
        protocol := strings.ToLower(string(port.Protocol))
        sourceIp := "0.0.0.0/0"

        permission := &ec2.IpPermission{}
        permission.FromPort = &portInt64
        permission.ToPort = &portInt64
        permission.IpRanges = []*ec2.IpRange{{CidrIp: &sourceIp}}
        permission.IpProtocol = &protocol

        permissions = append(permissions, permission)
    }
    _, err = s.ensureSecurityGroupIngress(securityGroupID, permissions)
    if err != nil {
        return nil, err
    }
}
securityGroupIDs := []string{securityGroupID}

.
.
.

}

There is no way to prevent it from creating a security group.