Stop silently ignoring spec.loadBalancerSourceRanges

Open Beginner friendly

#267 opened on Jul 5, 2026 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 2/5
Estimated time: 1-3 hours
Newbie friendliness: 82/100

Issue type: Bug
Clarity: Clearly specified
Activity status: Quiet
Tech stack: go, kubernetes
Domain: backend, cloud

Research direction

Start in internal/provider/load_balancer.go at the top of EnsureLoadBalancer, where the existing externalTrafficPolicy check is handled. Follow that pattern for services setting spec.loadBalancerSourceRanges, then run the relevant provider tests and verify that the service receives a clear error event instead of silent non-enforcement.

Written by the indexing model from the issue text.

Description

Bug Kubernetes Cloud Controller Manager (CCM)

Context

Users set spec.loadBalancerSourceRanges expecting traffic restriction. The CCM ignores it entirely — a security surprise: the user believes their service is firewalled when it isn't.

Scope

Short term: reject services that set this field, mirroring the existing externalTrafficPolicy check at the top of EnsureLoadBalancer (internal/provider/load_balancer.go).

Long term (file separately if pursued): map source ranges to VPC firewall rules.

Done when

A service setting loadBalancerSourceRanges gets a clear error event instead of silent non-enforcement.

Dominant language: Go
Stars: 6
Forks: 2
Avg merge: 2h 5m
Merged PRs (30d): 14

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

GrafeasNote is a duplicate resource of ContainerAnalysisNote Open

Difficulty 1/5 Under an hour Newbie friendliness 84/100

GoogleCloudPlatform/k8s-config-connector#13349 · Opened Sep 21, 2026
[receiver/receiverhelper] skip WithLinks when the parent span context is invalid Open

enhancement needs triage

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

open-telemetry/opentelemetry-collector#15998 · Opened Sep 21, 2026
🧹 Use PodSet wrappers in DRA tests Open

kind/cleanup

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

kubernetes-sigs/kueue#15947 · Opened Sep 21, 2026
Custom provider credential is written as `PROVIDER_API_KEY` (apiserver) but the AgentRun controller injects only allowlisted keys, so every custom provider fails with HTTP 401 Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

sympozium-ai/sympozium#627 · Opened Sep 21, 2026
A recording that opens with an all-zero last_throw emits a zeroed discThrown at frame 0 Open

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

EchoTools/tape#60 · Opened Sep 21, 2026

More Go issues