AWS security group support using kong ingress controller annotation in NLB

Questions
1

Hello Community,

We are currently running Kong Ingress Controller (KIC) version 2.8.1 and Kong Proxy version 3.1 within an AWS EKS cluster, where the Kong proxy Service is exposed via an AWS Network Load Balancer (NLB).

We recently installed the latest version of KIC, but encountered an issue when attempting to attach an existing AWS Security Group (SG) to the provisioned NLB using the standard Kubernetes Service annotation:

YAML

"service.beta.kubernetes.io/aws-load-balancer-security-groups": "sg-02d6474e862ee694a"

Problem: After deploying the new Ingress Controller, the NLB was created, but no Security Group was attached to it.

:red_question_mark: Key Questions

  1. Annotation Support: Does the latest version of the Kong Ingress Controller officially support the service.beta.kubernetes.io/aws-load-balancer-security-groups annotation for attaching an SG directly to the NLB Service in AWS?

  2. IP Restriction Alternative: If direct SG attachment via annotation is not supported, what is the recommended method to restrict traffic on ports 80 and 443 to only a specific list of public source IP addresses (CIDRs) for a public-facing NLB in this EKS setup?

Thank you for your guidance.

Regards, Pankaj