SecurityRuleAddressesOrPortsPerSecurityGroupLimitReached when service floating ip disabled

[ArchangelSDY]

What happened:

When floating IP is disabled for service, controller-manager creates a NSG rule that includes all backend pool nodes IPs as destination. In a cluster with 200+ nodes and 20+ services, we got following error from Azure:

Error syncing load balancer: failed to ensure load balancer: Retriable: false, RetryAfter: 0s, HTTPStatusCode: 400, RawError: {
  "error": {
    "code": "SecurityRuleAddressesOrPortsPerSecurityGroupLimitReached",
    "message": "Network security group /subscriptions/[REDACTED]/resourceGroups/[REDACTED]/providers/Microsoft.Network/networkSecurityGroups/k8s-nsg has 4094 DestinationAddressPrefixes. A security group cannot have more than 4000 DestinationAddressPrefixes as per the limit MaxSecurityRuleAddressesOrPortsPerSecurityGroup.",
    "details": []
  }
}

The NSG rules on portal look like:

There are 20+ rules in total. Each has 200+ destinations.

Looks like there's a limit of total destination address prefixes in a NSG. When the limit is reached, it blocks all following NSG update.

What you expected to happen:

I'm not sure if there exists a perfect fix. The quickest fix is that we instead use VirtualNetwork as destination. But that sacrifices some security.

How to reproduce it (as minimally and precisely as possible):

• Have a cluster with over 200 nodes
• Have 20+ services with service.beta.kubernetes.io/azure-disable-load-balancer-floating-ip set to true.
• Check controller-manager logs when it reconciles NSG.

Anything else we need to know?:

Environment:

• Kubernetes version (use kubectl version): 1.23
• Cloud provider or hardware configuration: 1.23.21
• OS (e.g: cat /etc/os-release):
• Kernel (e.g. uname -a):
• Install tools:
• Network plugin and version (if this is a network-related bug):
• Others:

[ArchangelSDY]

@nilo19

[nilo19]

It ishard to fix, unless the nsg team increases the limit.

[ArchangelSDY]

Is it possible

1. we add another annotation to let user choose to use VirtualNetwork instead?
2. or we use the fixed cluster node CIDR instead (not sure if that's available via config)?

Though we can fork and add a temporary fix, we hope we can have an official solution. Otherwise this becomes a blocker for us migrating to AKS in future.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.