(eks): KubectlProvider creates un-necessary security group for the provider function

[pkwarren]

The fix for #10200 updated the custom-resources provider to pass along the vpc and vpcSubnets ProviderProps. It however isn't passing down any configured security groups, which causes a new security group to be created for the lambdas.

It would help to reduce unnecessary security groups created by CDK if we could configure the security group for these lambdas or re-use cluster.kubectlSecurityGroup (if set).

Reference:

aws-cdk/packages/@aws-cdk/aws-eks/lib/kubectl-provider.ts

Lines 107 to 108 in e21a1d9

	vpc: cluster.kubectlPrivateSubnets ? cluster.vpc : undefined,
	vpcSubnets: cluster.kubectlPrivateSubnets ? { subnets: cluster.kubectlPrivateSubnets } : undefined,

aws-cdk/packages/@aws-cdk/aws-lambda/lib/function.ts

Lines 862 to 867 in e21a1d9

	const securityGroup = props.securityGroup || new ec2.SecurityGroup(this, 'SecurityGroup', {
	vpc: props.vpc,
	description: 'Automatic security group for Lambda Function ' + Names.uniqueId(this),
	allowAllOutbound: props.allowAllOutbound,
	});
	securityGroups = [securityGroup];

Reproduction Steps

Import a k8s cluster with fromClusterAttributes (with a configured vpc) and call addServiceAccount. In the nested stack, you'll see a security group created for the custom-resources lambdas:

{
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "Automatic security group for Lambda Function ...",
        "SecurityGroupEgress": [
          {
            "CidrIp": "0.0.0.0/0",
            "Description": "Allow all outbound traffic by default",
            "IpProtocol": "-1"
          }
        ]
    }
}

What did you expect to happen?

The custom-resources lambdas to be configured using the same security group as specified by cluster.kubectlSecurityGroup.

What actually happened?

A new security group is created for each CDK stack which creates a k8s service account.

Environment

• CDK CLI Version : 1.87.1
• Framework Version: 1.87.1
• Node.js Version: 14.15.4
• OS : Linux/Mac
• Language (Version): all

---

This is 🐛 Bug Report

[iliapolo]

@pkwarren You mention in the title this happens when upgrading from 1.77.0 - But this has always been the behavior.

I'll classify this as a feature request, but feel free to let me know if you think i'm missing something.

[pkwarren]

When I look through the history the behavior changed starting in 1.80.0 of aws-cdk. We encountered the issue when updating from 1.77.0 to 1.87.1 and have since rolled back (we prohibit creation of new security groups by the CDK pipeline).

[iliapolo]

@pkwarren You're right, the lambda function now creates the security group only because a VPC is passed to it. Which was changed in the PR you referenced.

Thanks for reporting this 👍

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.