{"action":"created","issue":{"url":"https://api.github.com/repos/pulumi/pulumi-aws/issues/805","repository_url":"https://api.github.com/repos/pulumi/pulumi-aws","labels_url":"https://api.github.com/repos/pulumi/pulumi-aws/issues/805/labels{/name}","comments_url":"https://api.github.com/repos/pulumi/pulumi-aws/issues/805/comments","events_url":"https://api.github.com/repos/pulumi/pulumi-aws/issues/805/events","html_url":"https://github.com/pulumi/pulumi-aws/issues/805","id":528504589,"node_id":"MDU6SXNzdWU1Mjg1MDQ1ODk=","number":805,"title":"Pulumi.Aws.Eks.ClusterArgs.VpcConfig.SecurityGroupsIds not manage \"Cluster security group\" but add \"Additional security groups\"","user":{"login":"guitarrapc","id":3856350,"node_id":"MDQ6VXNlcjM4NTYzNTA=","avatar_url":"https://avatars0.githubusercontent.com/u/3856350?v=4","gravatar_id":"","url":"https://api.github.com/users/guitarrapc","html_url":"https://github.com/guitarrapc","followers_url":"https://api.github.com/users/guitarrapc/followers","following_url":"https://api.github.com/users/guitarrapc/following{/other_user}","gists_url":"https://api.github.com/users/guitarrapc/gists{/gist_id}","starred_url":"https://api.github.com/users/guitarrapc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guitarrapc/subscriptions","organizations_url":"https://api.github.com/users/guitarrapc/orgs","repos_url":"https://api.github.com/users/guitarrapc/repos","events_url":"https://api.github.com/users/guitarrapc/events{/privacy}","received_events_url":"https://api.github.com/users/guitarrapc/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2019-11-26T05:51:48Z","updated_at":"2019-11-26T05:53:55Z","closed_at":null,"author_association":"NONE","body":"## TL;DR\r\n\r\n`SecurityGroupIds` should manage EKS Cluster's `Cluster security group`, but security groups are add to `Additional security groups`.\r\n\r\n## Summary\r\n\r\n`Pulumi.Aws.Eks.ClusterArgs` class will manage how eks cluster is configured and `VpcConfig.SecurityGroupIds` is the property to assign user security group.\r\n\r\nHowever, even if I assign security group ids to `SecurityGroupIds` but they all add to `Additional security groups` and `Cluster security group` will be automatically generated via EKS itself.\r\n\r\nIt result `pulumi destory` will stack with VPC because of EKS auto generated sg reference itself id in Ingress rule. (Manual remove ingress operation is required.)\r\n\r\n## Reproduce\r\n\r\n```csharp\r\nnew Pulumi.Aws.Eks.Cluster($\"sandbox-cluster\", new Pulumi.Aws.Eks.ClusterArgs\r\n{\r\n    RoleArn = \"arn:input_your_role_arn\",\r\n    Version = \"1.14\",\r\n    VpcConfig = new ClusterVpcConfigArgs\r\n    {\r\n        SecurityGroupIds = new [] { \"sg-0a513395f5cf69158\" },\r\n        SubnetIds = new [] { \"subnet-0777dd6b37013057a\", \"subnet-0d8e7a2afbcba86ae\" },\r\n    },\r\n});\r\n```\r\n\r\n## Expected behavior\r\n\r\n`sg-0a513395f5cf69158` would reference with `Cluster security group`.\r\n\r\n## Actual behavior\r\n\r\n`sg-0a513395f5cf69158` would reference with `Additional security groups`.\r\nSecurity group for `Cluster security group` will be automatically generated.\r\n\r\n![image](https://user-images.githubusercontent.com/3856350/69602540-4d1c7380-105b-11ea-9b55-2f68a0a66c21.png)\r\n\r\n![image](https://user-images.githubusercontent.com/3856350/69602614-966cc300-105b-11ea-9a7a-f791ad46ff80.png)\r\n\r\n## Terraform\r\n\r\nTerraform will assign user security group to `Cluster security group`, so current pulumi behavior is differ from original.\r\n\r\n```terraform.tf\r\nresource \"aws_eks_cluster\" \"main\" {\r\n  name     = \"sandbox-cluster\"\r\n  role_arn = \"arn:input_your_role_arn\"\r\n  version  = \"1.14\"\r\n  vpc_config {\r\n    subnet_ids         = [\"subnet-0777dd6b37013057a\", \"subnet-0d8e7a2afbcba86ae\"]\r\n    security_group_ids = [\"sg-0a513395f5cf69158\"]\r\n  }\r\n}\r\n```\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/pulumi/pulumi-aws/issues/comments/558472457","html_url":"https://github.com/pulumi/pulumi-aws/issues/805#issuecomment-558472457","issue_url":"https://api.github.com/repos/pulumi/pulumi-aws/issues/805","id":558472457,"node_id":"MDEyOklzc3VlQ29tbWVudDU1ODQ3MjQ1Nw==","user":{"login":"guitarrapc","id":3856350,"node_id":"MDQ6VXNlcjM4NTYzNTA=","avatar_url":"https://avatars0.githubusercontent.com/u/3856350?v=4","gravatar_id":"","url":"https://api.github.com/users/guitarrapc","html_url":"https://github.com/guitarrapc","followers_url":"https://api.github.com/users/guitarrapc/followers","following_url":"https://api.github.com/users/guitarrapc/following{/other_user}","gists_url":"https://api.github.com/users/guitarrapc/gists{/gist_id}","starred_url":"https://api.github.com/users/guitarrapc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guitarrapc/subscriptions","organizations_url":"https://api.github.com/users/guitarrapc/orgs","repos_url":"https://api.github.com/users/guitarrapc/repos","events_url":"https://api.github.com/users/guitarrapc/events{/privacy}","received_events_url":"https://api.github.com/users/guitarrapc/received_events","type":"User","site_admin":false},"created_at":"2019-11-26T05:53:55Z","updated_at":"2019-11-26T05:53:55Z","author_association":"NONE","body":"## Version\r\n\r\n```shell\r\n$ pulumi version\r\nv1.6.0\r\n$ pulumi plugin ls\r\nNAME  KIND      VERSION  SIZE    INSTALLED    LAST USED\r\naws   resource  1.10.0   185 MB  3 hours ago  3 hours ago\r\n```\r\n\r\nNuGet\r\n\r\n```\r\n    <PackageReference Include=\"Pulumi.Aws\" Version=\"1.10.0-preview\" />\r\n    <PackageReference Include=\"Pulumi\" Version=\"1.6.0-preview\" />\r\n```"}}
{"actor":{"display_login":"guitarrapc"}}