Description
Describe the bug
We are creating/grouping multiple SecurityGroups ACK objects into a single helm chart, along with other ACK objects (VPC, Subnets, etc). Some of these SGs need to be referenced in other SGs that are part of the same chart. Based on https://aws-controllers-k8s.github.io/community/reference/ec2/v1alpha1/securitygroup/ there are few options via userIDGroupPairs when a SG needs to be referenced in another SG: groupID or groupName. Given the SG ID is not known beforehand the only option left in this case is groupName. During our testing we found out that this option doesn't work as expected and we started getting errors like:
- lastTransitionTime: "2024-04-19T20:41:14Z"
status: "True"
type: ACK.ReferencesResolved
- message: "InvalidParameterCombination: An IP permission for a VPC security group may only include a group ID, not a group name.\n\tstatus code: 400, request id: de0f7840-4f3d-4b8d-8e38-d7107e9a318f"
status: "True"
type: ACK.Recoverable
- lastTransitionTime: "2024-04-19T20:41:15Z"
message: Unable to determine if desired resource state matches latest observed state
reason: "InvalidParameterCombination: An IP permission for a VPC security group may only include a group ID, not a group name.\n\tstatus code: 400, request id: de0f7840-4f3d-4b8d-8e38-d7107e9a318f"
status: Unknown
type: ACK.ResourceSynced
or
- lastTransitionTime: "2024-04-19T20:41:15Z"
status: "True"
type: ACK.ReferencesResolved
- message: "VPCIdNotSpecified: No default VPC for this user\n\tstatus code: 400, request id: 1ae9d2e2-a5dc-439f-b323-909a12bfea29"
status: "True"
type: ACK.Recoverable
- lastTransitionTime: "2024-04-19T20:41:16Z"
message: Unable to determine if desired resource state matches latest observed state
reason: "VPCIdNotSpecified: No default VPC for this user\n\tstatus code: 400, request id: 1ae9d2e2-a5dc-439f-b323-909a12bfea29"
status: Unknown
type: ACK.ResourceSynced
Steps to reproduce
Create a security group object like:
❯ k get securitygroup ci-sbx -oyaml | k neat
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: SecurityGroup
metadata:
annotations:
services.k8s.aws/region: us-west-2
name: ci-sbx
spec:
description: Applied to all instances
egressRules:
- fromPort: 1
ipProtocol: tcp
toPort: 65535
userIDGroupPairs:
- description: Allow all nodes to communicate
groupName: ci-sbx-2
userID: "<accountID>"
ingressRules:
- fromPort: -1
ipProtocol: icmp
toPort: -1
userIDGroupPairs:
- description: Allow all nodes to communicate ICMP
groupName: ci-sbx-2
userID: "<accountID>"
name: ci-sbx
tags:
- key: Name
value: ci-sbx-k8s
- key: AckName
value: ci-sbx
vpcRef:
from:
name: ci-sbx
Check the status of the newly created object:
❯ kubectl describe securitygroup ci-sbx
Expected outcome
Security group should be created without issues.
If VPC ID is not specified inside the userIDGroupPairs, use the one referenced via the vpcRef setting.
Other options might include adding support for securitygroupref or vpcRef settings inside the userIDGroupPairs .
Environment
- Kubernetes version: 1.28
- Using EKS (yes/no), if so version?: yes, 1.28
- AWS service targeted (S3, RDS, etc.): security groups