Create a NACL in the k8s cluster

Oct 13, 2025 by wbrum.org 130 views

Introduction

Network ACLs (NACLs) are a crucial component of Amazon Web Services (AWS) security, allowing administrators to control inbound and outbound traffic to and from subnets. However, a recent issue has been reported where NACL rules are not created properly in the AWS console. This article will delve into the details of this issue, including the steps to reproduce it, the expected outcome, and the environment in which it occurs.

Describe the Bug

The bug in question is related to the creation of NACL rules in the AWS console. Specifically, it has been observed that NACL rules are not created properly, resulting in incorrect or missing rules. This issue is a follow-up to a previous problem reported in the AWS Controllers for Kubernetes (ACK) community, which can be found at https://github.com/aws-controllers-k8s/community/issues/2241.

Steps to Reproduce

To reproduce this issue, follow these steps:

Create a NACL in the k8s cluster: Use the following YAML configuration to create a NACL in the k8s cluster:

apiVersion: ec2.services.k8s.aws/v1alpha1
kind: NetworkACL
metadata:
  name: demo-itaiatu-test2
  namespace: sbx-clusters
  annotations:
    services.k8s.aws/region: us-east-1
spec:
  associations:
    - subnetID: subnet-04ceee7dff3fe90f4
  entries:
    - cidrBlock: 0.0.0.0/0
      egress: false
      protocol: "6"
      portRange:
        from: 80
        to: 80
      ruleAction: allow
      ruleNumber: 100
  vpcID: vpc-0361ffbb3d7a097e4
  tags:
    - key: Name
      value: demo-itaiatu-test2

Verify the NACL status: After creating the NACL, verify its status using the following YAML configuration:

...
  tags:
  - key: Name
    value: demo-itaiatu-test2
  vpcID: vpc-0361ffbb3d7a097e4
status:
  ackResourceMetadata:
    ownerAccountID: "258057316678"
    region: us-east-1
  conditions:
  - lastTransitionTime: "2025-03-12T13:31:52Z"
    message: Resource synced successfully
    reason: ""
    status: "True"
    type: ACK.ResourceSynced
  id: acl-0a15a4c496cd94e55
  isDefault: false
  ownerID: "258057316678"

Observe the NACL rules in the AWS Console: After creating the NACL, observe the rules in the AWS Console. Initially, the NACL will not have the rule with number 100, but only the default rules. However, after approximately 10 minutes, the rule with number 100 will appear in the console.

Expected Outcome

The expected outcome is the same as the previous issue reported in the ACK community, which can be found at https://github.com/aws-controllers-k8s/community/issues/2241.

Environment

The environment in which this issue occurs is as follows:

Kubernetes version: 1.29
Using EKS (yes/no): Yes
EKS version: 1.29
AWS service targeted: EC2 v1.3.7

Additional Observations

Another interesting observation is that the rule with number 100 is added to the default NACL, but with incorrect protocol and portRange values, both for Ingress and Egress. This can be seen in the following images:

Ingress:
Egress:

In conclusion, the issue of NACL rules not being created properly in the AWS console is a complex problem that requires further investigation. The steps to reproduce this issue have been outlined, and the expected outcome has been described. Additionally, the environment in which this issue occurs has been specified. Further research is needed to resolve this issue and ensure that NACL rules are created correctly in the AWS console.

Introduction

In our previous article, we discussed the issue of NACL rules not being created properly in the AWS console. This article will provide a Q&A section to address some of the common questions related to this issue.

Q: What is the cause of this issue?

A: The cause of this issue is not yet fully understood, but it is believed to be related to the way NACL rules are created and synchronized between the k8s cluster and the AWS console.

Q: How can I reproduce this issue?

A: To reproduce this issue, follow the steps outlined in our previous article. Create a NACL in the k8s cluster using the provided YAML configuration, and then verify the NACL status and observe the rules in the AWS Console.

Q: What is the expected outcome?

A: The expected outcome is the same as the previous issue reported in the ACK community, which can be found at https://github.com/aws-controllers-k8s/community/issues/2241.

Q: What is the environment in which this issue occurs?

A: The environment in which this issue occurs is as follows:

Kubernetes version: 1.29
Using EKS (yes/no): Yes
EKS version: 1.29
AWS service targeted: EC2 v1.3.7

Q: Why are the rules not being created properly?

A: The rules are not being created properly due to a synchronization issue between the k8s cluster and the AWS console. This issue is still being investigated, and a resolution is pending.

Q: What are the implications of this issue?

A: The implications of this issue are significant, as it can lead to security vulnerabilities and misconfigured NACL rules. It is essential to address this issue as soon as possible to ensure the security and integrity of your AWS resources.

Q: How can I work around this issue?

A: To work around this issue, you can try the following:

Use the AWS CLI: Instead of using the AWS Console, try using the AWS CLI to create and manage NACL rules.
Use a third-party tool: Consider using a third-party tool, such as a NACL management tool, to create and manage NACL rules.
Contact AWS Support: If you are experiencing issues with NACL rules, contact AWS Support for assistance.

Q: Is this issue specific to EKS?

A: No, this issue is not specific to EKS. It can occur with any k8s cluster that is using the AWS console to manage NACL rules.

Q: Is this issue related to other AWS services?

A: No, this issue is specific to NACL rules and the AWS console. It is not related to other AWS services, such as S3 or RDS.

Q: What is the current status of this issue?

A: The current status of this issue is that it is still being investigated, and a resolution is pending. We will provide updates as more information becomes available.

Q: How can I stay informed about this issue?

A: To stay informed about this issue, follow the ACK community on GitHub, and subscribe to the AWS blog for updates on this issue and other AWS-related topics.