Proposal: enable to attach user defined security groups for worker instances. about kube-aws

[pieterlange]

I fully agree and ran into this myself a few times.

The feature itself will be easy to add if we all agree we should implement this using a "glue" security group which is externally managed. We've recently added a bunch of "external" dependencies (EFS, still talking about external etcd) that leave some management up to the cluster operator, so i think this is fine too.

[mumoshu]

I'm ok with the glue security group 👍

I believe that's considerably better than making inconvenience like "kube-aws destroy seems to failed somehow.. oh, I'd been forgetting about the nearly invisible dependency from sg-db to sg-w....".

(Full disclosure: @everpeace is my colleague

[mumoshu]

OK so I believe it is now easier than ever to support additional security group(s) assigned to worker nodes since the experimental node pools feature landed.

Both the stack-template.json template and the nodepool/config.go which is the foundation of the template are already aware of any number(actually up to EC2 limit) of security groups assigned to each worker node in a pool:

https://github.com/coreos/kube-aws/blob/master/nodepool/config/config.go#L214-L220
https://github.com/coreos/kube-aws/blob/master/nodepool/config/templates/stack-template.json#L1-L7

Anyone likes to contribute here? 😃