Repository: aws-ia/terraform-aws-eks-blueprints

Issue #328: [FEATURE] Provide example for additional security group to managed node group
Created: 2022-03-09T10:42:28Z
Is your feature request related to a problem? Please describe
I am struggeling for weeks to add security groups to a managed node group. I need firewall rules that allow incoming traffic on two ports. This is a follow-up of #219. Looking into the code the interplay of create_worker_security_group, create_launch_template and worker_additional_security_group_ids inside the managed_node_groups definition seems to be relevant, but it is not clear to me.
Describe the solution you'd like
Provide a working example to add a security group to managed nodes groups that allows traffic on certain ports.

Duplicate issue #1452: vpc_security_group_ids parameter is ignored
Created: 2023-02-23T20:27:05Z
Description

 ✋ I have searched the open/closed issues and my issue is not listed.
  reinitialized terraform directory

Versions


Module version [Required]:


Terraform version:
Terraform v1.3.7
on windows_amd64


Provider version(s):



provider registry.terraform.io/gavinbunney/kubectl v1.14.0
provider registry.terraform.io/hashicorp/aws v4.53.0
provider registry.terraform.io/hashicorp/cloudinit v2.2.0
provider registry.terraform.io/hashicorp/helm v2.8.0
provider registry.terraform.io/hashicorp/kubernetes v2.17.0
provider registry.terraform.io/hashicorp/local v2.3.0
provider registry.terraform.io/hashicorp/null v3.2.1
provider registry.terraform.io/hashicorp/random v3.4.3
provider registry.terraform.io/hashicorp/time v0.9.1
provider registry.terraform.io/hashicorp/tls v4.0.4
provider registry.terraform.io/terraform-aws-modules/http v2.4.1

Reproduction Code [Required]
resource "aws_security_group" "ingress_sg" {
  name_prefix = "ingress"
  description = "inbound rules"
  vpc_id      = module.vpc.vpc_id
  ingress {
    protocol    = "tcp"
    from_port   = 8000
    to_port     = 8000
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }
}

module "eks_blueprints" {
  source = "github.com/aws-ia/terraform-aws-eks-blueprints?ref=v4.22.0"

  cluster_name    = local.cluster_name
  cluster_version = "1.24"

  vpc_id             = module.vpc.vpc_id
  private_subnet_ids = module.vpc.private_subnets
  cluster_endpoint_public_access = true
  managed_node_groups = {
    node_groups = {
      node_group_name = "node_group"
      ami_type = "AL2_ARM_64"
      capacity_type = "ON_DEMAND"

      instance_types = [
        "c6g.xlarge"
      ]

      min_size     = 1
      max_size     = 10
      desired_size = 1

      subnet_ids      = module.vpc.public_subnets
      vpc_security_group_ids = [
        "${aws_security_group.ingress_sg.id}"
      ]
    }
  }
}
Steps to reproduce the behavior:
Adding or removing the segment
      vpc_security_group_ids = [
        "${aws_security_group.ingress_sg.id}"
      ]

does not trigger any change in the plan, it reports "No changes. Your infrastructure matches the configuration."
Expected behaviour
External security group is applied to the managed node group.
Actual behaviour
Security group is successfully created, but is not applied.

Closing comment (2023-02-23T21:31:06Z): I believe this is related to #328, but I am still keeping it open because this seems like a somewhat trivial addition to managed_ng resource.