Skip to main content
Assign network security groups to Managed Kubernetes node groups to control traffic to and from your cluster’s nodes.

​
Prerequisites

Before assigning security groups to a node group, you need to create them. See Managing security groups for instructions on creating groups and defining rules.
If you use your own security groups to restrict egress traffic, make sure that the cluster can still access the resources it needs. For example, blocking outbound internet access can break functionality that depends on it, such as pulling images from external registries.

​
How to assign security groups when creating a node group

Use --template-network-interfaces to assign security groups when creating a node group: 
nebius mk8s node-group create \
  --parent-id <cluster_ID> \
  --name <node_group_name> \
  --template-resources-platform <platform> \
  --template-resources-preset <preset> \
  --template-network-interfaces "[{\"subnet_id\": \"<subnet_ID>\", \"security_groups\": [{\"id\": \"<security_group_ID_1>\"}, {\"id\": \"<security_group_ID_2>\"}]}]"

​
How to update security groups on an existing node group

nebius mk8s node-group update \
  --template-network-interfaces "[{\"subnet_id\": \"<subnet_ID>\", \"security_groups\": [{\"id\": \"<security_group_ID_1>\"}, {\"id\": \"<security_group_ID_2>\"}]}]" \
  <node_group_ID>