Change:
Is this a BUG REPORT or FEATURE REQUEST?: /kind bug What happened: When specifying multiple services using the annotation the SG defined in that annotation may be the one used for ingress to the instances. If this happens for multiple service ELBs and one of those services is removed then the rule may be removed during clean up causing the other ELBs losing the ability to contact their instances. What you expected to happen: Removal of any service should not lead to disruption of other services. How to reproduce it (as minimally and precisely as possible): a security group in AWS. multiple services referencing that SG in . one of those services. Environment: Kubernetes version (use ): 1.8.8 Cloud provider or hardware configuration: AWS Kernel (e.g. ): 4.4.121-k8s
From what I can tell this is a result of the simple selection of what to consider the LB security group here: I'd think a solution would be to prefer an SG tagged as kube owned if one is present (which there should always be if one is created for the LB as expected). I should be able to get a PR together if that sounds like an appropriate fix.
This may also be related to
/sig aws
Also
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale

Discussion:
// Note that this is annoying: the load balancer disappears from the API immediately, but it is still // deleting in the background.  We get a DependencyViolation until the load balancer has deleted itself <ins> var loadBalancerSGs = aws.StringValueSlice(lb.SecurityGroups) describeRequest := &ec2.DescribeSecurityGroupsInput{} filters := []*ec2.Filter{ newEc2Filter("group-id", loadBalancerSGs...), } describeRequest.Filters = c.tagging.addFilters(filters) response, err := c.ec2.DescribeSecurityGroups(describeRequest) if err != nil { return fmt.Errorf("error querying security groups for ELB: %q", err) } </ins> // Collect the security groups to delete securityGroupIDs := map[string]struct{}{} <del> for _, securityGroupID := range lb.SecurityGroups { if *securityGroupID == c.cfg.Global.ElbSecurityGroup { //We don't want to delete a security group that was defined in the Cloud Configurationn. </del> <ins> for _, sg := range response { sgID := aws.StringValue(sg.GroupId) if sgID == c.cfg.Global.ElbSecurityGroup { //We don't want to delete a security group that was defined in the Cloud Configuration. </ins> continue } <del> if aws.StringValue(securityGroupID) == "" { klog.Warning("Ignoring empty security group in ", service.Name) </del> <ins> if sgID == "" { klog.Warningf("Ignoring empty security group in %s", service.Name) </ins> continue } <del> securityGroupIDs[*securityGroupID] = struct{}{} </del> <ins> if !c.tagging.hasClusterTag(sg.Tags) { klog.Warningf("Ignoring security group with no cluster tag in %s", service.Name) continue } securityGroupIDs[sgID] = struct{}{} </ins> } // Loop through and try to delete them