Kubernetes and AWS: Set LoadBalancer to use predefined Security Group

Question

As the title says, I am looking for a way to force a LoadBalancer service to use a predefined security group in AWS. I do not want to have to manually edit the inbound/outbound

Answer 1

You cannot prevent Kubernetes from creating a new security group. But since Andonaeus' answer was submitted a new feature has been added which allows for explicitly defining inbound permissions via your service's configuration file.

See the user guide details for the specifics. The example provided there shows that by using spec.loadBalancerSourceRanges you can provide allow inbound IPs:

In the following example, a load blancer will be created that is only accessible to clients with IP addresses from 130.211.204.1 and 130.211.204.2.

apiVersion: v1
kind: Service
metadata:
  name: myapp
spec:
  ports:
    - port: 8765
      targetPort: 9376
  selector:
    app: example
  type: LoadBalancer
  loadBalancerSourceRanges:
  - 130.211.204.1/32
  - 130.211.204.2/32

Answer 2

I realize this post is now a couple of years old, but it came up for me in a google search. It looks like it is now possible with k8s 1.7+ to prevent kubernetes from creating a security group. See https://github.com/kubernetes/kops/blob/release-1.9/docs/cluster_spec.md#cloudconfig for more info.

Answer 3

It looks like this is not currently possible. Via the following code in the api, https://github.com/kubernetes/kubernetes/blob/37b5726716231c13117c4b05a841e00417b92cda/pkg/cloudprovider/providers/aws/aws.go :

func (s *AWSCloud) EnsureLoadBalancer(name, region string, publicIP net.IP, ports []*api.ServicePort, hosts []string, affinity api.ServiceAffinity) (*api.LoadBalancerStatus, error) {
glog.V(2).Infof("EnsureLoadBalancer(%v, %v, %v, %v, %v)", name, region,    publicIP, ports, hosts)

.
.
.

// Create a security group for the load balancer
var securityGroupID string
{
    sgName := "k8s-elb-" + name
    sgDescription := "Security group for Kubernetes ELB " + name
    securityGroupID, err = s.ensureSecurityGroup(sgName, sgDescription, vpcId)
    if err != nil {
        glog.Error("Error creating load balancer security group: ", err)
        return nil, err
    }

    permissions := []*ec2.IpPermission{}
    for _, port := range ports {
        portInt64 := int64(port.Port)
        protocol := strings.ToLower(string(port.Protocol))
        sourceIp := "0.0.0.0/0"

        permission := &ec2.IpPermission{}
        permission.FromPort = &portInt64
        permission.ToPort = &portInt64
        permission.IpRanges = []*ec2.IpRange{{CidrIp: &sourceIp}}
        permission.IpProtocol = &protocol

        permissions = append(permissions, permission)
    }
    _, err = s.ensureSecurityGroupIngress(securityGroupID, permissions)
    if err != nil {
        return nil, err
    }
}
securityGroupIDs := []string{securityGroupID}

.
.
.

}

There is no way to prevent it from creating a security group.

Answer 4

You can not restrict kubernetes from creating new security group, but you can specify existing security groups using annotations as mentioned in the documentation:

service.beta.kubernetes.io/aws-load-balancer-extra-security-groups: "sg-53fae93f,sg-42efd82e" -> A list of additional security groups to be added to ELB