NACL: Rules are not created properly

[itaiatu]

Describe the bug
NACL rules are not created properly in the AWS console.
This is a follow-up issue of #2241.

Steps to reproduce
I have created the following NACL in the k8s cluster

apiVersion: ec2.services.k8s.aws/v1alpha1
kind: NetworkACL
metadata:
  name: demo-itaiatu-test2
  namespace: sbx-clusters
  annotations:
    services.k8s.aws/region: us-east-1
spec:
  associations:
    - subnetID: subnet-04ceee7dff3fe90f4
  entries:
    - cidrBlock: 0.0.0.0/0
      egress: false
      protocol: "6"
      portRange:
        from: 80
        to: 80
      ruleAction: allow
      ruleNumber: 100
  vpcID: vpc-0361ffbb3d7a097e4
  tags:
    - key: Name
      value: demo-itaiatu-test2

Object's status

...
  tags:
  - key: Name
    value: demo-itaiatu-test2
  vpcID: vpc-0361ffbb3d7a097e4
status:
  ackResourceMetadata:
    ownerAccountID: "258057316678"
    region: us-east-1
  conditions:
  - lastTransitionTime: "2025-03-12T13:31:52Z"
    message: Resource synced successfully
    reason: ""
    status: "True"
    type: ACK.ResourceSynced
  id: acl-0a15a4c496cd94e55
  isDefault: false
  ownerID: "258057316678"

When looking in the AWS Console, in the first ~10 minutes, demo-itaiatu-test2 NACL didn't have the 100 rule, but only the default ones (even if the status - posted above - said that the resource is synced)

After ~10 minutes (maybe on the next reconciliation - object updates), the rule with number 100 appeared in the console.

Another weird part is that on the default NACL, the rule with number 100 is added, but with wrong protocol and portRange, both on Ingress and Egress.

• Ingress
  
• Egress
  

Expected outcome
Same as #2241.

Environment

• Kubernetes version 1.29
• Using EKS (yes/no), if so version? 1.29
• AWS service targeted (S3, RDS, etc.) EC2 v1.3.7

[eqe-aws]

We are looking into this.

[rushmash91]

Hi @itaiatu ,
Thank you for reporting the issue.

The default NACL behavior you are noticing with the rule number 100 is expected. AWS creates those for your VPC. You can read more about it here: Default network ACL for a VPC.

Will be sending a patch for the creation delay.