Support AWS Security Groups with security group rules ingress from another security group for Network Policies

[franceschongg]

I'm looking to convert pod security groups over to either Network Policies or Cilium Network Policies.

Currently, both those CRs will support CIDR ranges, but with AWS Security Groups, there's an ability to have a security group rule for ingress that references another security group. This is common when it's an ec2 security group allowing ingress from the alb security group.

The feature request I'd like is to support the case where a security group can have another security group as the ingress.

Is this something that could be supported? It doesn't have to be in the Network Policy, it could also be at the Cilium Network Policy.

[squeed]

Interesting; can you explain this a bit more? (I like this idea; I sometimes think labels can be too finicky).

Would it be something like

kind: CiliumNetworkPolicy
spec:
  endpointSelector:
    matchLabels:
      env: dev
  ingress:
    - fromPolicy:
        name: "storage"
---
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "storage"
spec:
  endpointSelector:
    matchLabels:
      storage: "true"

[franceschongg]

I was thinking it would be something like this

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "l4-rule"
spec:
  endpointSelector:
    matchLabels:
      role: backend
  ingress:
  - fromEndpoints:
    awsSecurityGroups:
      - yourAWSSecurityGroupID
    toPorts:
    - ports:
      - port: "80"
        protocol: TCP

[shashankram]

Hey @franceschongg, to understand your request better, could you clarify what is your expectation from using CiliumNetworkPolicies to reference EC2 security group IDs? Do you want Cilium to auto-discover the pods that belong to a security group without needing to specify pod selectors? I am a bit confused because the mapping of pods -> security groups is handled via a custom resource (SecurityGroupPolicy) when using the Pod Security Group feature in EKS, and I am wondering why the CiliumNetworkPolicies cannot be used as-is.

[Alex-Waring]

I am also interested in this, my requirement would not be for pods but for things like load balancers and RDS, that I can associate an SG to and then allow that SG into the pod with cilium.

[shashankram]

then allow that SG into the pod with cilium.

What do you mean by this? Are you referring to a form of associating security groups to pods or to allow pods to accept traffic from AWS resources belonging to the security group?

[Alex-Waring]

Allowing pods to accept traffic from AWS resources associated with an SG. Probably by looking up ENIs, seeing which ones have the SG attached, and converting that into a list of CIDRs

[shashankram]

@franceschongg could you clarify what you mean by The feature request I'd like is to support the case where a security group can have another security group as the ingress. Do you just want to define Cilium policies to allow ingress from a security group or something more?

[Alex-Waring]

I've created #30708 as a draft starting point as what I envisaged.

[franceschongg]

@shashankram Yeap - that's correct. I'd like to define Cilium policies to allow ingress / egress from a AWS security group

[JonasKs]

I'd like to define Cilium policies to allow ingress / egress from a AWS security group

I've created #31768, which basically says:

I'd like to define Cilium policies to allow ingress / egress from an external system