Create load balancer service fails in NSG mode

[bhperry]

Is this a BUG REPORT or FEATURE REQUEST?

BUG REPORT

Versions

CCM Version:
Not sure how to find this with OKE

Environment:

• Kubernetes version (use kubectl version): 1.29.1 deployed with OKE

What happened?

Creating a load balancer service with the following annotations:

    oci.oraclecloud.com/load-balancer-type: lb
    oci.oraclecloud.com/oci-backend-network-security-group: <backend-nsg-id>
    oci.oraclecloud.com/security-rule-management-mode: NSG

Fails on CreateNetworkSecurityGroup, which based on this documentation I believe is from the CCM trying to create the frontend NSG.

Event from describe svc:

  Warning  SyncLoadBalancerFailed  24s                 service-controller  Error syncing load balancer: failed to ensure load balancer: Error returned by VirtualNetwork Service. Http Status Code: 404. Error Code: NotAuthorizedOrNotFound. Opc request id: 6319a3b33450a38770f1ed9dd8392fb5/167BB1DB14918BAA44591B1D0D74F27E/873953462D53AEA58D5A1C46BC364E9A. Message: Authorization failed or requested resource not found..
Operation Name: CreateNetworkSecurityGroup
Timestamp: 2024-11-11 20:00:58 +0000 GMT
Client Version: Oracle-GoSDK/65.75.1
Request Endpoint: POST https://iaas.us-ashburn-1.oraclecloud.com/20160918/networkSecurityGroups
Troubleshooting Tips: See https://docs.oracle.com/iaas/Content/API/References/apierrors.htm#apierrors_404__404_notauthorizedornotfound for more information about resolving this error.
Also see https://docs.oracle.com/iaas/api/#/en/iaas/20160918/NetworkSecurityGroup/CreateNetworkSecurityGroup for details on this operation's requirements.
To get more info on the failing request, you can set OCI_GO_SDK_DEBUG env var to info or higher level to log the request/response details.
If you are unable to resolve this VirtualNetwork issue, please contact Oracle support and provide them this full error message.

It looks as though the CCM does not have permission to create an NSG.

What you expected to happen?

CCM should be able to create and manage frontend NSG.

How to reproduce it (as minimally and precisely as possible)?

apiVersion: v1
kind: Service
metadata:
  annotations:
    oci.oraclecloud.com/load-balancer-type: lb
    oci.oraclecloud.com/security-rule-management-mode: NSG
    oci.oraclecloud.com/oci-backend-network-security-group: <backend-nsg-id>
  name: test-lb
spec:
  allocateLoadBalancerNodePorts: true
  externalTrafficPolicy: Cluster
  internalTrafficPolicy: Cluster
  ports:
  - appProtocol: http
    name: http
    port: 80
    protocol: TCP
    targetPort: http
  - appProtocol: https
    name: https
    port: 443
    protocol: TCP
    targetPort: https
  selector:
    some: label
  type: LoadBalancer