---
title: "Manage a cluster's security groups"
description: "Attach and detach security groups on an E2E Kubernetes cluster, or allow all traffic, for the master node and every worker node at once."
content_type: "how-to"
product: "kubernetes"
platform: "MyAccount"
url: "/myaccount/kubernetes/how-to/manage-security-groups/"
topic: ["networking-and-storage"]
relationships: {"requires":["/myaccount/security-group/how-to/create-a-security-group/"]}
---

# Manage a cluster's security groups

Security groups are the firewall rules for your cluster's nodes: they control traffic to the nodes'
own IPs, and kubectl reaches the cluster because an attached group allows TCP port 6443.

A cluster's **Security Groups** tab is the same screen nodes have: you attach one or more groups,
detach them, and use **Allow All Traffic**. Every change applies to the master node and every worker
node at once.

## Before you begin

- Your cluster reads **Running**.
- The group you want to attach exists, with the rules you need. See
  [Create a security group](/myaccount/security-group/how-to/create-a-security-group/) and
  [Add or edit rules](/myaccount/security-group/how-to/add-or-edit-rules/).
- If you are a team member, your role has the update permission for Kubernetes.

## Know the groups a cluster carries

- The security group you chose when you created the cluster. It must allow inbound TCP port 6443 and
  UDP port 8472 at creation. The ports are checked only then, so keep a group that allows TCP 6443
  attached: kubectl reaches the cluster only while an attached group allows TCP port 6443 from where
  you connect.
- A group named `sg-svc-<number>`, described as **K8s Private LB IP Security Group**, that E2E adds
  when you reserve a private LB IP. It allows all traffic to and from that IP.

Public service IPs have no group of their own. A LoadBalancer service on a public service IP is
reachable on every port it exposes, whatever the attached groups allow; to limit who reaches it, set
its source ranges, as
[Limit who can reach the service](/myaccount/kubernetes/how-to/expose-a-service-with-a-load-balancer/#optional-limit-who-can-reach-the-service)
shows.

To let other traffic reach the nodes, add a rule to an attached group instead of attaching a new
one; see [Add or edit rules](/myaccount/security-group/how-to/add-or-edit-rules/).

## Attach or detach a group

1. In MyAccount, under **Compute**, click **Kubernetes**, click your cluster's name, and open the
   **Security Groups** tab.
2. Attach or detach groups as you would on a node. The steps are in
   [Attach a security group to a node](/myaccount/security-group/how-to/attach-a-security-group-to-a-node/)
   and
   [Detach a security group from a node](/myaccount/security-group/how-to/detach-a-security-group-from-a-node/).

At least one security group must stay attached. Detaching the last one is refused with
**Atleast one security group must be present.**

## (Optional) Allow all traffic

To find out whether a security group rule is what blocks some traffic, click **Allow All Traffic**
on the **Security Groups** tab. It creates an allow-all group if you have none, and attaches it. If
the group is already attached, you see **Security Group Already Attached.**

An allow-all group lets any traffic reach every node in the cluster. Once you have found the rule
you need, add it to your own group, and detach the allow-all group.

The groups you chose now cover every node in the cluster. To check that kubectl still connects, run
`kubectl get nodes`; if it times out, see
[Troubleshooting Kubernetes](/myaccount/kubernetes/troubleshooting/kubernetes/#kubectl-times-out-on-port-6443).