Add support for configuring Loadbalancer security group for PowerVS Clusters

[Karthik-K-N]

/kind feature
/area provider/ibmcloud

User Story

What would you like to be added?

IBMPowerVSCluster spec enabled the user to provide SG for LB via field

cluster-api-provider-ibmcloud/api/v1beta2/ibmpowervscluster_types.go

Line 129 in a792076

LoadBalancers []VPCLoadBalancerSpec `json:"loadBalancers,omitempty"`

.
But currently its not supported and ignored.

Add support for create SG for LB.

Example: "As a [developer/user/operator], I would like to [high-level description] for [reasons]."

Detailed Feature Description

Provide a clear and concise description of the new feature or the improvement to an existing feature.

Context & Motivation

What problem does this solve, and why is it important?
Explain the motivation behind this request. How does this feature improve the project? What specific use cases does it address?

Proposed Solution

How should this be implemented?
Describe potential approaches for implementing this feature. If possible, provide links to related documentation or prior discussions.

Alternatives Considered

Have you considered any alternatives?
List any alternative solutions or workarounds you've considered and explain why they may or may not be suitable.

Additional Information

Anything else you would like to add?
Include screenshots, references, or additional context that can assist in understanding and implementing the request.

/label area/powervs

[k8s-ci-robot]

@Karthik-K-N: The label(s) /label area/powervs cannot be applied. These labels are supported: api-review, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, team/katacoda, refactor, ci-short, ci-extended, ci-full. Is this label configured under labels -> additional_labels or labels -> restricted_labels in plugin.yaml?

In response to this:

/kind feature
/area provider/ibmcloud

User Story

What would you like to be added?

IBMPowerVSCluster spec enabled the user to provide SG for LB via field

cluster-api-provider-ibmcloud/api/v1beta2/ibmpowervscluster_types.go

Line 129 in a792076

LoadBalancers []VPCLoadBalancerSpec `json:"loadBalancers,omitempty"`

.
But currently its not supported and ignored.

Add support for create SG for LB.

Example: "As a [developer/user/operator], I would like to [high-level description] for [reasons]."

Detailed Feature Description

Provide a clear and concise description of the new feature or the improvement to an existing feature.

Context & Motivation

What problem does this solve, and why is it important?
Explain the motivation behind this request. How does this feature improve the project? What specific use cases does it address?

Proposed Solution

How should this be implemented?
Describe potential approaches for implementing this feature. If possible, provide links to related documentation or prior discussions.

Alternatives Considered

Have you considered any alternatives?
List any alternative solutions or workarounds you've considered and explain why they may or may not be suitable.

Additional Information

Anything else you would like to add?
Include screenshots, references, or additional context that can assist in understanding and implementing the request.

/label area/powervs

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[aonexyz]

Thanks for raising this request the need is clear.

Right now the LoadBalancers []VPCLoadBalancerSpec field in IBMPowerVSCluster is exposed in the API, but the controller logic completely ignores the SG configuration for PowerVS load balancers. So even if the user specifies a security group, it has no effect.

Supporting SG creation/attachment for LB would be useful for:

• restricting inbound traffic by CIDR or protocol
• aligning with enterprise compliance rules
• ensuring consistent behavior with VPC load balancers on non-PowerVS platforms

Why this feature makes sense

PowerVS users often need fine-grained control over inbound rules, especially when deploying clusters in regulated environments. Since CAPI already exposes the field, enabling actual enforcement would make the API consistent and predictable.

Proposed approach

• Extend the PowerVS LB reconciliation logic to:
  1. create a security group if one is specified in the spec
  2. attach the SG to the load balancer on provisioning
  3. reconcile updates if the SG configuration changes
• Validate the field during admission to avoid silent ignoring
• Provide documentation & examples for users

Alternatives

• Users manually create and attach SGs through IBM Cloud UI/CLI after cluster creation - but this breaks automation.
• Ignore the field - current behavior, but inconsistent with the API design.

Additional notes

If needed, I can help test or verify the controller behavior once an implementation or PR is available.

Thanks again for surfacing this enabling SG support for LB would make the PowerVS provider more complete and reduce surprises for users.

[arshadd-b]

/assign