Change default security-list management mode to None for OCI Load Balancer and Network Load Balancer Services

Aperta
  • Qualcosa non va?
#536 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
go
Ambito
cloud

Direzione di ricerca

Non sono indicati file sorgente o test. Inizia individuando il valore predefinito per la gestione delle security lists e la gestione delle annotazioni per i percorsi OCI Load Balancer e Network Load Balancer. Verifica che le annotazioni mancanti lascino invariate le security lists, che i valori espliciti None e All rimangano disponibili, che i valori non validi adottino un comportamento fail closed o generino un avviso chiaro e che il valore predefinito sicuro sia documentato.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

OCI Cloud Controller Manager should stop using automatic OCI security-list management as the implicit default for OKE/Kubernetes Service type=LoadBalancer.

For both OCI Load Balancer and OCI Network Load Balancer paths, the default security-list management behavior should be None, meaning CCM should not mutate OCI security lists unless the user explicitly opts in.

Today, users must know and remember annotations such as:

service.beta.kubernetes.io/oci-load-balancer-security-list-management-mode: "None"

and, for NLB:

oci-network-load-balancer.oraclecloud.com/security-list-management-mode: "None"

This makes safe behavior opt-out rather than default.

Problem

Security lists are subnet-scoped network perimeter controls, not resources local to a single Kubernetes Service. When CCM automatically manages security lists, a Kubernetes Service manifest can indirectly mutate OCI network ingress rules.

For classic OCI Load Balancer, the documented default security-list management mode is All. This can result in broad ingress rules being added unless users explicitly set the annotation to None.

This is risky because every application team, Helm chart, Terraform module, and platform owner must remember the annotation. A single missed annotation can unintentionally widen network exposure, including public ingress such as 0.0.0.0/0.

Request

Please change OCI CCM so automatic security-list management is opt-in, not opt-out.

Desired default:

security-list-management-mode = None

for all OCI load balancer types provisioned through CCM, including:

  • OCI Load Balancer
  • OCI Network Load Balancer

Legacy behavior should remain available only when explicitly configured, for example:

service.beta.kubernetes.io/oci-load-balancer-security-list-management-mode: "All"

or

oci-network-load-balancer.oraclecloud.com/security-list-management-mode: "All"

Compatibility / migration options

If changing the default immediately is too disruptive, please consider one of these migration paths:

  1. Change the default to None only for new clusters or future CCM versions.
  2. Add a cluster-level CCM configuration option to set the default security-list management mode.
  3. Allow administrators to set:
    default-security-list-management-mode = None

once at the cluster level, without requiring every Service manifest to repeat the annotation.
4. Keep per-Service annotations as explicit overrides.
5. Deprecate implicit All behavior over time with warnings and release notes.

Desired behavior

  • CCM does not mutate OCI security lists by default.
  • Users who want CCM-managed security-list rules must explicitly opt in.
  • Missing annotations should not result in All.
  • Invalid annotations should fail closed or warn clearly, rather than silently falling back to a permissive default.
  • Documentation should recommend NSGs or explicitly managed security rules as the secure default path.

Why this matters

The current default makes network exposure dependent on every workload author remembering an annotation. For platform teams and OCI customers, the safer model is that shared network perimeter controls are not changed automatically unless explicitly requested.

Secure default should be:

Do not manage security lists unless explicitly configured to do so.

Lingua principale
Go
Stelle
160
Fork
109
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di oracle/oci-cloud-controller-manager

Tutte le issue di oracle/oci-cloud-controller-manager

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.