Description of problem:

`oc get service --all-namespaces | grep LoadBalancer`
Service LoadBalancers managed by OpenShift use a "{{ item.value.name }}_k8s" AWS security-group. 

The following code tries to ensure the AWS security-groups exist.

https://github.com/openshift/openshift-ansible/blob/706d0643371bc84706879a10ae18619582dd605a/roles/openshift_aws/tasks/security_group.yml#L18-L25

- name: create the k8s sgs for the node group
  ec2_group:
    name: "{{ item.value.name }}_k8s"
    description: "{{ item.value.desc }} for k8s"
    region: "{{ openshift_aws_region }}"
    vpc_id: "{{ vpcout.vpcs[0].id }}"
  with_dict: "{{ openshift_aws_node_security_groups }}"
  register: k8s_sg_create


As there is no "rules" key in the above code, the security groups are created empty. 

The problem exists when the existing security groups both exist and are not empty (they contain ELB security group rules allowing access to nodes from ELBs).

When this rule is executed, the existing rules in the "{{ item.value.name }}_k8s" AWS security groups are destroyed, blocking access from ELBs to Instances. All Instances will go "OutOfService" and connectivity is lost.

OpenShift does not auto-heal this case. 

Version-Release number of selected component (if applicable):

openshift-ansible release-3.11

How reproducible:

100%

Steps to Reproduce:

Re-run security-groups to update for any changes.

Actual results:

Rules allowing Service LoadBalancer ELBs access to Instances are removed.

Expected results:

Rules allowing Service LoadBalancer ELBs access to Instances should be maintained.

Additional info:

This could be fixed in openshift-ansible, or in the OpenShift Service LoadBalancer implementation for auto-heal.