Manage a cluster's security groups

Security groups are the firewall rules for your cluster’s nodes: they control traffic to the nodes’ own IPs, and kubectl reaches the cluster because an attached group allows TCP port 6443.

A cluster’s Security Groups tab is the same screen nodes have: you attach one or more groups, detach them, and use Allow All Traffic. Every change applies to the master node and every worker node at once.

Before you begin

• Your cluster reads Running.
• The group you want to attach exists, with the rules you need. See Create a security group and Add or edit rules.
• If you are a team member, your role has the update permission for Kubernetes.

Know the groups a cluster carries

• The security group you chose when you created the cluster. It must allow inbound TCP port 6443 and UDP port 8472 at creation. The ports are checked only then, so keep a group that allows TCP 6443 attached: kubectl reaches the cluster only while an attached group allows TCP port 6443 from where you connect.
• A group named sg-svc-<number>, described as K8s Private LB IP Security Group, that E2E adds when you reserve a private LB IP. It allows all traffic to and from that IP.

Public service IPs have no group of their own. A LoadBalancer service on a public service IP is reachable on every port it exposes, whatever the attached groups allow; to limit who reaches it, set its source ranges, as Limit who can reach the service shows.

To let other traffic reach the nodes, add a rule to an attached group instead of attaching a new one; see Add or edit rules.

Attach or detach a group

1. In MyAccount, under Compute, click Kubernetes, click your cluster’s name, and open the Security Groups tab.
2. Attach or detach groups as you would on a node. The steps are in Attach a security group to a node and Detach a security group from a node.

At least one security group must stay attached. Detaching the last one is refused with Atleast one security group must be present.

(Optional) Allow all traffic

To find out whether a security group rule is what blocks some traffic, click Allow All Traffic on the Security Groups tab. It creates an allow-all group if you have none, and attaches it. If the group is already attached, you see Security Group Already Attached.

An allow-all group lets any traffic reach every node in the cluster. Once you have found the rule you need, add it to your own group, and detach the allow-all group.

The groups you chose now cover every node in the cluster. To check that kubectl still connects, run kubectl get nodes; if it times out, see Troubleshooting Kubernetes.