Cluster-api-provider-aws: AWS LoadBalancer doesn't like multiple Security Groups on instances

[rudoi]

/kind bug

What steps did you take and what happened:

Created a Service with type LoadBalancer:

 Warning  CreatingLoadBalancerFailed  10s (x3 over 26s)  service-controller  Error creating load balancer (will retry): failed to ensure load balancer for service default/my-service: Multiple tagged security groups found for instance i-00112233; ensure only the k8s security group is tagged; the tagged groups were sg-123(controlplane) sg-456(node)

What did you expect to happen:

Load Balancer is created!

Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]
I will look into the k/k integration first thing next week and see what's going on...

Environment:

• Cluster-api-provider-aws version: Master
• Kubernetes version: (use kubectl version): 1.13.2
• OS (e.g. from /etc/os-release): Ubuntu

[detiber]

Is this related to the kubernetes.io/cluster/<name>=owned tags? If so, we can likely get away with just setting that on the "node" security group, there should be no reason that we need to add the "control plane" security group to a Service LoadBalancer.

[detiber]

Part of me also wonders if it would be better to have a "service" security group so that we only expose the Service ports to autogenerated ELBs instead of all of the "node" ports, but that would also cause potential problems for anyone wanting to add additional security groups to hosts.

[rudoi]

Is this related to the kubernetes.io/cluster/<name>=owned tags? If so, we can likely get away with just setting that on the "node" security group, there should be no reason that we need to add the "control plane" security group to a Service LoadBalancer.

Thought about this issue over the weekend and reached this same conclusion. I'll start putting it together and testing it out.

[rudoi]

@detiber any thoughts on why this only popped up this past Friday? We've had LoadBalancers successfully running for quite some time...

[detiber]

@rudoi I suspect it might be related to https://github.com/kubernetes-sigs/cluster-api-provider-aws/commit/c694a556e993c243326d63e38f09ee167dfdd6b8

[rudoi]

@detiber I think #706 will fix this actually...

[chuckha]

this is fixed

/close

[k8s-ci-robot]

@chuckha: Closing this issue.

In response to this:

this is fixed

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.