[Feature Request] Ability to specify additional node security group rules about pulumi-eks HOT 4 CLOSED

The proposed API for 1. would be to add

additionalNodeSecurityGroupRules: pulumi.Input<{
  egress?: pulumi.Input<pulumi.Input<{
      cidrBlocks?: pulumi.Input<pulumi.Input<string>[]>;
      description?: pulumi.Input<string>;
      fromPort: pulumi.Input<number>;
      ipv6CidrBlocks?: pulumi.Input<pulumi.Input<string>[]>;
      prefixListIds?: pulumi.Input<pulumi.Input<string>[]>;
      protocol: pulumi.Input<string>;
      securityGroups?: pulumi.Input<pulumi.Input<string>[]>;
      self?: pulumi.Input<boolean>;
      toPort: pulumi.Input<number>;
  }>[]>,
  ingress?: pulumi.Input<pulumi.Input<{
    cidrBlocks?: pulumi.Input<pulumi.Input<string>[]>;
    description?: pulumi.Input<string>;
    fromPort: pulumi.Input<number>;
    ipv6CidrBlocks?: pulumi.Input<pulumi.Input<string>[]>;
    prefixListIds?: pulumi.Input<pulumi.Input<string>[]>;
    protocol: pulumi.Input<string>;
    securityGroups?: pulumi.Input<pulumi.Input<string>[]>;
    self?: pulumi.Input<boolean>;
    toPort: pulumi.Input<number>;
  }>[]>
}>;

rules that will be simply merged with the default rules in createNodeGroupSecurityGroup(https://github.com/pulumi/pulumi-eks/blob/master/nodejs/eks/securitygroup.ts#L35).

Although I'd prefer 2., which is more flexible (for example, you can't replace the default egress default "allow all" with something more specific by using 1.), I would propose something like

nodeSecurityGroupTransform?: (pulumi.Input<aws.ec2.SecurityGroup>) => pulumi.Input<aws.ec2.SecurityGroup>;

which can either mutate the provided security group, or return a new one.

@lukehoban @metral What do you think?

from pulumi-eks.

I'm thinking option 1 is the best path forward here as it makes expectations clear about the user brings and what the cluster requires.

@lukehoban thoughts?

from pulumi-eks.

@lbogdan @lukehoban @metral

agree that option 1 is better because a) the alb ingress group implementation relies on the EKS node-security group; and b) nodes allow for multiple security groups;

When implementing this the logic 1 thing to consider is that the ALB/ELB/NLB in k8s will use the default security group on the node with the clustertag. If a new SG with the same clustertag is found then an error will be logged, so we need to factor that in when implementing option 1.

from pulumi-eks.

Closing in favor of #275

from pulumi-eks.