AWS EKS集群eksclusterrole自动添加0.0.0.0/0安全组入站规则问题

• 该操作是AWS EKS内置控制器的默认行为：EKS会通过关联的eksclusterrole角色，定期同步集群内LoadBalancer类型Service对应的安全组配置，保证安全组规则与Kubernetes Service的声明配置完全对齐，手动在AWS控制台修改的规则会被强制覆盖。
• 若未在Service配置中显式指定允许访问的源IP范围，EKS控制器默认会为对应负载均衡安全组添加0.0.0.0/0的对应端口入站规则，同时默认开放公网ICMP访问，和你在CloudTrail中查到的操作日志完全吻合：

{
    "type": "Role",
    "principalId": "blablabla",
    "arn": "arn:aws:iam::MyAccountId:role/eksclusterrole",
    "accountId": "MyAccountId",
    "userName": "eksclusterrole"
},
"webIdFederationData": {},
"attributes": {
    "mfaAuthenticated": "false",
    "creationDate": "date"
}
},
"invokedBy": "eks.amazonaws.com"
},
"eventTime": "date",
"eventSource": "ec2.amazonaws.com",
"eventName": "AuthorizeSecurityGroupIngress",
"awsRegion": "us-east-2",
"sourceIPAddress": "eks.amazonaws.com",
"userAgent": "eks.amazonaws.com",
"requestParameters": {
    "groupId": "sg-mysecurityid",
    "ipPermissions": {
        "items": [
            {
                "ipProtocol": "icmp",
                "fromPort": 3,
                "toPort": 4,
                "groups": {},
                "ipRanges": {
                    "items": [
                        {
                            "cidrIp": "0.0.0.0/0"
                        }
                    ]
                },
                "ipv6Ranges": {},
                "prefixListIds": {}
            },
            {
                "ipProtocol": "tcp",
                "fromPort": 27017,
                "toPort": 27017,
                "groups": {},
                "ipRanges": {
                    "items": [
                        {
                            "cidrIp": "0.0.0.0/0"
                        }
                    ]
                },
                "ipv6Ranges": {},
                "prefixListIds": {}
            }
        ]
    }
}

• 调整MongoDB关联的LoadBalancer Service配置，添加以下Annotation，显式指定允许访问的源IP并关闭ICMP公网访问：

apiVersion: v1
kind: Service
metadata:
  name: mongodb-lb
  annotations:
    # 仅允许指定IP访问27017端口，多个IP段用英文逗号分隔
    service.beta.kubernetes.io/load-balancer-source-ranges: "117.123.111.99/32"
    # 关闭默认的公网ICMP访问规则
    service.beta.kubernetes.io/aws-load-balancer-allow-icmp: "false"
spec:
  type: LoadBalancer
  # 其余原有配置保持不变

• 所有负载均衡安全组的规则调整必须通过修改Kubernetes Service的配置实现，不要直接在AWS控制台手动修改安全组规则，避免后续控制器同步时手动配置被覆盖。

内容的提问来源于stack exchange，提问作者basava022