Support Warm Pool for Security Group for Pods

[abhipth]

Problem
Currently we create Branch Network Interface on demand in the VPC Resource Controller which adds up to higher pod startup latency at scale.

Supporting Warm Pool for Security Group Policy would alleviate the pod startup latency.

Challenges
Creating a warm pool for Security Group Policy requires solving a couple of major challenges

• Scheduler level awareness for mapping the pod requiring SGP to the right node with the WP.
• Warm pool for ENIs using Security Group form multiple Security Group Policy requires pre configuration from user because there can be any combination of SGP used by the pod based on the label selection criteria.

[JasonMichalski-at]

I have also see the vpc-resource-controller hitting AWS rate limits creating the Branch Network Interfaces while updating a deployments. For my use case the deployment is so large that most nodes have at least one pod with the correct Branch Network Interface already attached. So I expect that even a simpler change to delay removing the interface so it could be reused during a rolling update would be a large improvement.

Are there any plans to work on this?

[haouc]

@JasonMichalski-at thanks for resurfacing this. we are looking into this for a design consideration.

[Dark0096]

@abhipth, @haouc Are there any development plans for this feature?

[sushrk]

Closing this in favor of aws/containers-roadmap#2192