Change default security-list management mode to None for OCI Load Balancer and Network Load Balancer Services
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
Research direction
No source files or tests are named. Start by locating the security-list management default and annotation handling for both OCI Load Balancer and Network Load Balancer paths. Verify that missing annotations leave security lists unchanged, explicit None and All remain available, invalid values fail closed or warn clearly, and the secure default is documented.
Written by the indexing model from the issue text.
Description
Summary
OCI Cloud Controller Manager should stop using automatic OCI security-list management as the implicit default for OKE/Kubernetes Service type=LoadBalancer.
For both OCI Load Balancer and OCI Network Load Balancer paths, the default security-list management behavior should be None, meaning CCM should not mutate OCI security lists unless the user explicitly opts in.
Today, users must know and remember annotations such as:
service.beta.kubernetes.io/oci-load-balancer-security-list-management-mode: "None"
and, for NLB:
oci-network-load-balancer.oraclecloud.com/security-list-management-mode: "None"
This makes safe behavior opt-out rather than default.
Problem
Security lists are subnet-scoped network perimeter controls, not resources local to a single Kubernetes Service. When CCM automatically manages security lists, a Kubernetes Service manifest can indirectly mutate OCI network ingress rules.
For classic OCI Load Balancer, the documented default security-list management mode is All. This can result in broad ingress rules being added unless users explicitly set the annotation to None.
This is risky because every application team, Helm chart, Terraform module, and platform owner must remember the annotation. A single missed annotation can unintentionally widen network exposure, including public ingress such as 0.0.0.0/0.
Request
Please change OCI CCM so automatic security-list management is opt-in, not opt-out.
Desired default:
security-list-management-mode = None
for all OCI load balancer types provisioned through CCM, including:
- OCI Load Balancer
- OCI Network Load Balancer
Legacy behavior should remain available only when explicitly configured, for example:
service.beta.kubernetes.io/oci-load-balancer-security-list-management-mode: "All"
or
oci-network-load-balancer.oraclecloud.com/security-list-management-mode: "All"
Compatibility / migration options
If changing the default immediately is too disruptive, please consider one of these migration paths:
- Change the default to None only for new clusters or future CCM versions.
- Add a cluster-level CCM configuration option to set the default security-list management mode.
- Allow administrators to set:
default-security-list-management-mode = None
once at the cluster level, without requiring every Service manifest to repeat the annotation.
4. Keep per-Service annotations as explicit overrides.
5. Deprecate implicit All behavior over time with warnings and release notes.
Desired behavior
- CCM does not mutate OCI security lists by default.
- Users who want CCM-managed security-list rules must explicitly opt in.
- Missing annotations should not result in All.
- Invalid annotations should fail closed or warn clearly, rather than silently falling back to a permissive default.
- Documentation should recommend NSGs or explicitly managed security rules as the secure default path.
Why this matters
The current default makes network exposure dependent on every workload author remembering an annotation. For platform teams and OCI customers, the safer model is that shared network perimeter controls are not changed automatically unless explicitly requested.
Secure default should be:
Do not manage security lists unless explicitly configured to do so.
- Dominant language
- Go
- Stars
- 160
- Forks
- 109
- PR merge metrics
- No merged PRs in 30d
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from oracle/oci-cloud-controller-manager
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Established connections are dropped when cluster-autoscaler scales down a load balancer backend nodeOpen
Difficulty 4/5 3-5 days Newbie friendliness 28/100
-
Difficulty 4/5 3-5 days Newbie friendliness 15/100
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
oracle/oci-cloud-controller-manager#546 · 1 reaction ·
-
Difficulty 3/5 1-2 days Newbie friendliness 75/100
All issues in oracle/oci-cloud-controller-manager
Similar issues
-
[Bug] Custom tool truncation leaves unused stream copies openPossibly taken @OUAO-FRANK claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
[v3] KeyBindingManager calls (Add/Remove) are not converted into a case-insensitive accelerator.KeyOpenBug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
crmne/hyprmoncfg#114 · 1 comment ·
Maintainers usually reply within 1 day
-
runtime: usleep sleeps nanoseconds instead of microseconds on linux/mips and linux/mips64Possibly taken @BRobertson7 claimed this today. Opencompiler/runtime
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day