> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nebius.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to assign security groups to a node group in Managed Service for Kubernetes®

Assign network security groups to Managed Kubernetes node groups to control traffic to and from your cluster's nodes.

## Prerequisites

Before assigning security groups to a node group, you need to create them. See [Managing security groups](/vpc/security-groups/manage) for instructions on creating groups and defining rules.

<Warning>
  If you use your own security groups to restrict egress traffic, make sure that the cluster can still access the resources it needs. For example, blocking outbound internet access can break functionality that depends on it, such as pulling images from external registries.
</Warning>

## How to assign security groups when creating a node group

Use `--template-network-interfaces` to assign security groups when creating a node group:

```bash theme={null}
nebius mk8s node-group create \
  --parent-id <cluster_ID> \
  --name <node_group_name> \
  --template-resources-platform <platform> \
  --template-resources-preset <preset> \
  --template-network-interfaces "[{\"subnet_id\": \"<subnet_ID>\", \"security_groups\": [{\"id\": \"<security_group_ID_1>\"}, {\"id\": \"<security_group_ID_2>\"}]}]"
```

## How to update security groups on an existing node group

```bash theme={null}
nebius mk8s node-group update \
  --template-network-interfaces "[{\"subnet_id\": \"<subnet_ID>\", \"security_groups\": [{\"id\": \"<security_group_ID_1>\"}, {\"id\": \"<security_group_ID_2>\"}]}]" \
  <node_group_ID>
```