[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for Kubernetes](../index.md) > [Application Load Balancer tools](index.md) > Configuring security groups

# Configuring security groups for Application Load Balancer tools in Yandex Managed Service for Kubernetes 

{% note tip %}

We recommend using the new [Yandex Cloud Gwin](gwin-index.md) controller instead of an ALB Ingress controller and Gateway API.

{% endnote %}

To ensure proper operation of the [ingress controller](ingress-controller/index.md) and [Gateway API](gateway-api/index.md), you must configure appropriate [security groups](../../vpc/concepts/security-groups.md) for your [cluster](../concepts/index.md#kubernetes-cluster), [Yandex Managed Service for Kubernetes node groups](../concepts/index.md#node-group), and [Application Load Balancer](../../application-load-balancer/concepts/application-load-balancer.md).

We recommend using separate security groups for your cluster, node groups, and load balancer, although a shared group is also permitted.

Within each security group, you must configure:
* All required security group rules documented in the relevant guides:
  * For cluster and node groups, see the [Configuring security groups](../operations/connect/security-groups.md) section of the Managed Service for Kubernetes documentation.
  * For the load balancer, see [Security groups](../../application-load-balancer/concepts/application-load-balancer.md#security-groups). The final outbound rule for [backend](../../application-load-balancer/concepts/backend-group.md) VMs must allow connections to either the CIDR range of your cluster’s [node group](../concepts/index.md#node-group) [subnet](../../vpc/concepts/network.md#subnet) or the security group associated with your node groups.
* Backend health check rules, allowing:
  * The load balancer to send TCP traffic to port 10501 on cluster nodes, targeting either the node groups’ subnet CIDR ranges or their security groups.
  * Node groups to receive TCP traffic on port 10501 from either the load balancer’s subnet CIDR ranges or its security group.

Security groups for both the cluster and node groups are specified in their respective configurations. For more information, see the guides below:
* [Creating](../operations/kubernetes-cluster/kubernetes-cluster-create.md) and [updating a cluster](../operations/kubernetes-cluster/kubernetes-cluster-update.md#update-cluster).
* [Creating](../operations/node-group/node-group-create.md) and [updating a node group](../operations/node-group/node-group-update.md).

Security group IDs are specified in the following configuration locations:
* For the `Ingress` resource, in the `ingress.alb.yc.io/security-groups` annotation. A load balancer associated with multiple `Ingress` resources aggregates all security groups defined in their configurations.
* For the `Gateway` resource, in the `gateway.alb.yc.io/security-groups` annotation.

## Configuration example {#example}

Let's assume you need to create rules for the following conditions:

* You need to deploy a load balancer with a [public IP address](../../vpc/concepts/address.md#public-addresses) to accept HTTPS traffic in three subnets with `10.128.0.0/24`, `10.129.0.0/24`, and `10.130.0.0/24` CIDR blocks (\[B\]).
* The cluster’s CIDR block is `10.96.0.0/16` (\[C\]), and the service CIDR block is `10.112.0.0/16` (\[S\]).
* The cluster's node group resides in a subnet with the CIDR block `10.140.0.0/24` (\[Nod\]).
* SSH [access](../operations/node-connect-ssh.md) to nodes and cluster management (via API, `kubectl`, etc.) are restricted to CIDR `203.0.113.0/24` (\[Con\]).

### Management console {#example-console}

Create the following security groups and rules:

* [Load balancer security group](../../application-load-balancer/concepts/application-load-balancer.md#security-groups):

  {% list tabs group=traffic %}

  - Outgoing traffic {#outgoing}

    Port range | Protocol | Destination name | CIDR blocks | Description
    --- | --- | --- | --- | ---
    `0-65535` | `TCP` | `CIDR` | `10.140.0.0/24`[^\[Nod\]^](#example) | For outgoing traffic to nodes, including status checks

  - Incoming traffic {#incoming}

    Port range | Protocol | Source | CIDR blocks | Description
    --- | --- | --- | --- | ---
    `80` | `TCP` | `CIDR` | `0.0.0.0/0` | For receiving incoming HTTP traffic
    `443` | `TCP` | `CIDR` | `0.0.0.0/0` | For receiving incoming HTTPS traffic
    `30080` | `TCP` | `Load balancer healthchecks` | — | For load balancer node status checks

  {% endlist %}

* Node group’s security group for backend health checks:

  {% list tabs group=traffic %}

  - Incoming traffic {#incoming}

    Port range | Protocol | Source | CIDR blocks | Description
    --- | --- | --- | --- | ---
    `10501` | `TCP` | `CIDR` | `10.128.0.0/24`[^\[B\]^](#example)<br>`10.129.0.0/24`[^\[B\]^](#example)<br>`10.130.0.0/24`[^\[B\]^](#example) | For backend health checks

  {% endlist %}

* Cluster and node group’s security group for control plane traffic:

  {% list tabs group=traffic %}

  - Outgoing traffic {#outgoing}

    Port range | Protocol | Destination name | CIDR blocks | Description
    --- | --- | --- | --- | ---
    `0-65535` | `Any` | `Security group` | `Current` | For traffic between the [control plane](../concepts/index.md#master) components and worker nodes

  - Incoming traffic {#incoming}

    Port range | Protocol | Source | CIDR blocks | Description
    --- | --- | --- | --- | ---
    `0-65535` | `TCP` | `Load balancer healthchecks` | — | For a network load balancer
    `0-65535` | `Any`| `Security group` | `Current` | For traffic between the control plane components and worker nodes
    `0-65535` | `ICMPv6` | `CIDR` | `10.0.0.0/8`<br>`192.168.0.0/16`<br>`172.16.0.0/12` | For node health checks within Yandex Cloud subnets

  {% endlist %}

* Node group’s security group for control plane traffic:

  {% list tabs group=traffic %}

  - Outgoing traffic {#outgoing}

    Port range | Protocol | Destination name | CIDR blocks | Description
    --- | --- | --- | --- | ---
    `0-65535` | `Any` | `CIDR` | `0.0.0.0/0` | For external resource access

  - Incoming traffic {#incoming}

    Port range | Protocol | Source | CIDR blocks | Description
    --- | --- | --- | --- | ---
    `0-65535` | `Any` | `CIDR` | `10.96.0.0/16`[^\[C\]^](#example)<br>`10.112.0.0/16`[^\[S\]^](#example) | For [pod](../concepts/index.md#pod) to [service](../concepts/index.md#service) communication

  {% endlist %}

* Cluster security group for control plane traffic:

  {% list tabs group=traffic %}

  - Outgoing traffic {#outgoing}

    Port range | Protocol | Destination name | CIDR blocks | Description
    --- | --- | --- | --- | ---
    `4443` | `TCP` | `CIDR` | `10.96.0.0/16`[^\[C\]^](#example) | For traffic between the control plane components and `metric-server` [pods](../concepts/index.md#pod)

  - Incoming traffic {#incoming}

    Port range | Protocol | Destination name | CIDR blocks | Description
    --- | --- | --- | --- | ---
    `443` | `TCP` | `CIDR` | `203.0.113.0/24`[^\[Con\]^](#example) | For Kubernetes API access
    `6443` | `TCP` | `CIDR` | `203.0.113.0/24`[^\[Con\]^](#example) | For Kubernetes API access

  {% endlist %}

* Node group’s security group for internet service access:

  {% list tabs group=traffic %}

  - Incoming traffic {#incoming}

    Port range | Protocol | Source | CIDR blocks | Description
    --- | --- | --- | --- | ---
    `30000-32767` | `TCP` | `CIDR` | `0.0.0.0/0` | For internet and Yandex Cloud access

  {% endlist %}

* Security group for SSH access to node group instances:

  {% list tabs group=traffic %}

  - Incoming traffic {#incoming}

    Port range | Protocol | Source | CIDR blocks | Description
    --- | --- | --- | --- | ---
    `22` | `TCP` | `CIDR` | `203.0.113.0/24`[^\[Con\]^](#example) | For SSH access to nodes

  {% endlist %}

For details on security groups for cluster and node groups, see [Configuring security groups](../operations/connect/security-groups.md).

### Terraform {#example-terraform}

Create the following security groups and rules:

```hcl
locals {
  network-id = "<cloud_network_ID>"
}

resource "yandex_vpc_security_group" "alb" {
  description = "Load balancer security group"
  name        = "alb"
  network_id  = local.network-id
  ingress {
    description    = "Rule to allow incoming HTTP traffic"
    port           = 80
    protocol       = "TCP"
    v4_cidr_blocks = ["0.0.0.0/0"]
  }
  ingress {
    description    = "Rule to allow incoming HTTPS traffic"
    port           = 443
    protocol       = "TCP"
    v4_cidr_blocks = ["0.0.0.0/0"]
  }
  ingress {
    description       = "Rule for load balancer node health checks"
    port              = 30080
    protocol          = "TCP"
    predefined_target = "loadbalancer_healthchecks"
  }
  egress {
    description    = "Rule for sending traffic to nodes, including health checks"
    from_port      = 0
    to_port        = 65535
    protocol       = "TCP"
    v4_cidr_blocks = ["10.140.0.0/24"]
  }
}

resource "yandex_vpc_security_group" "nodegroup-backend" {
  description = "Node group's security group for backend health checks"
  name        = "nodegroup-backend"
  network_id  = local.network-id
  ingress {
    description    = "Backend health check rule"
    port           = 10501
    protocol       = "TCP"
    v4_cidr_blocks = ["10.128.0.0/24", "10.129.0.0/24", "10.130.0.0/24"]
  }
}

resource "yandex_vpc_security_group" "k8s-cluster-nodegroup-traffic" {
  description = "Cluster and node group's security group for service traffic"
  name        = "k8s-cluster-nodegroup-traffic"
  network_id  = local.network-id
  ingress {
    description       = "Network load balancer rule"
    from_port         = 0
    to_port           = 65535
    protocol          = "TCP"
    predefined_target = "loadbalancer_healthchecks"
  }
  ingress {
    description       = "Rule for traffic between the master and nodes"
    from_port         = 0
    to_port           = 65535
    protocol          = "ANY"
    predefined_target = "self_security_group"
  }
  ingress {
    description    = "Rule for health checks of nodes from subnets within Yandex Cloud"
    from_port      = 0
    to_port        = 65535
    protocol       = "IPV6_ICMP"
    v4_cidr_blocks = ["10.0.0.0/8", "192.168.0.0/16", "172.16.0.0/12"]
  }
  egress {
    description       = "Rule for traffic between the master and nodes"
    from_port         = 0
    to_port           = 65535
    protocol          = "ANY"
    predefined_target = "self_security_group"
  }
}

resource "yandex_vpc_security_group" "nodegroup-traffic" {
  description = "Node group's security group for service traffic"
  name        = "nodegroup-traffic"
  network_id  = local.network-id
  ingress {
    description    = "Rule for traffic between pods and services"
    from_port      = 0
    to_port        = 65535
    protocol       = "ANY"
    v4_cidr_blocks = ["10.96.0.0/16", "10.112.0.0/16"]
  }
  egress {
    description    = "Rule for external resource access"
    from_port      = 0
    to_port        = 65535
    protocol       = "ANY"
    v4_cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "yandex_vpc_security_group" "k8s-cluster-traffic" {
  description = "Cluster security group for control plane traffic"
  name        = "k8s-cluster-traffic"
  network_id  = local.network-id
  ingress {
    description    = "Rule for access to the Kubernetes API"
    port           = 443
    protocol       = "TCP"
    v4_cidr_blocks = ["203.0.113.0/24"]
  }
  ingress {
    description    = "Rule for access to the Kubernetes API"
    port           = 6443
    protocol       = "TCP"
    v4_cidr_blocks = ["203.0.113.0/24"]
  }
  egress {
    description    = "Rule for traffic between the master and metric-server pods"
    port           = 4443
    protocol       = "TCP"
    v4_cidr_blocks = ["10.96.0.0/16"]
  }
}

resource "yandex_vpc_security_group" "nodegroup-services-access" {
  description = "Node group's security group for accessing services from the internet"
  name        = "nodegroup-services-access"
  network_id  = local.network-id
  ingress {
    description    = "Rules for accessing services from the internet and Yandex Cloud subnets"
    from_port      = 30000
    to_port        = 32767
    protocol       = "TCP"
    v4_cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "yandex_vpc_security_group" "nodegroup-ssh" {
  description = "Node group's security group for SSH access to nodes"
  name        = "nodegroup-ssh"
  network_id  = local.network-id
  ingress {
    description    = "Rules for SSH access to nodes"
    port           = 22
    protocol       = "TCP"
    v4_cidr_blocks = ["203.0.113.0/24"]
  }
}
```