code: func (c *Cloud) buildELBSecurityGroupList(serviceName types.NamespacedName, loadBalancerName string, annotations map[string]string) ([]string, error) {
  	var err error
  	var securityGroupID string
  
  	if c.cfg.Global.ElbSecurityGroup != "" {
  		securityGroupID = c.cfg.Global.ElbSecurityGroup
  	} else {
  		// Create a security group for the load balancer
  		sgName := "k8s-elb-" + loadBalancerName
  		sgDescription := fmt.Sprintf("Security group for Kubernetes ELB %s (%v)", loadBalancerName, serviceName)
  		securityGroupID, err = c.ensureSecurityGroup(sgName, sgDescription, getLoadBalancerAdditionalTags(annotations))
  		if err != nil {
  			klog.Errorf("Error creating load balancer security group: %q", err)
  			return nil, err
  		}
  	}
  
  	sgList := []string{}
  
  	for _, extraSG := range strings.Split(annotations[ServiceAnnotationLoadBalancerSecurityGroups], ",") {
  		extraSG = strings.TrimSpace(extraSG)
  		if len(extraSG) > 0 {
  			sgList = append(sgList, extraSG)
  		}
  	}
  
  	// If no Security Groups have been specified with the ServiceAnnotationLoadBalancerSecurityGroups annotation, we add the default one.
  	if len(sgList) == 0 {
  		sgList = append(sgList, securityGroupID)
  	}
  
  	for _, extraSG := range strings.Split(annotations[ServiceAnnotationLoadBalancerExtraSecurityGroups], ",") {
  		extraSG = strings.TrimSpace(extraSG)
  		if len(extraSG) > 0 {
  			sgList = append(sgList, extraSG)
  		}
  	}
  
  	return sgList, nil
  }
docs: // buildELBSecurityGroupList returns list of SecurityGroups which should be
  // attached to ELB created by a service. List always consist of at least
  // 1 member which is an SG created for this service or a SG from the Global config.
  // Extra groups can be specified via annotation, as can extra tags for any
  // new groups. The annotation "ServiceAnnotationLoadBalancerSecurityGroups" allows for
  // setting the security groups specified.