[Yandex Cloud documentation](../../../index.md) > [Yandex Managed Service for Kubernetes](../../index.md) > [Step-by-step guides](../index.md) > Managing a Kubernetes cluster > Creating a Kubernetes cluster

# Creating a Managed Service for Kubernetes cluster


Create a [Managed Service for Kubernetes cluster](../../concepts/index.md#kubernetes-cluster) and then [create a node group](../node-group/node-group-create.md).

To create a cluster with no internet access, see [Creating and configuring a Kubernetes cluster with no internet access](../../tutorials/k8s-cluster-with-no-internet.md).

## Getting started {#before-you-begin}

{% list tabs group=instructions %}

- Management console {#console}

  1. Go to the [management console](https://console.yandex.cloud). If you have not signed up yet, navigate to the management console and follow the instructions.
  1. On the [**Yandex Cloud Billing**](https://center.yandex.cloud/billing/accounts) page, make sure you have a [billing account](../../../billing/concepts/billing-account.md) linked and its status is `ACTIVE` or `TRIAL_ACTIVE`. If you do not have a billing account yet, [create one](../../../billing/quickstart/index.md#create_billing_account).
  1. If you do not have a [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) yet, [create one](../../../resource-manager/operations/folder/create.md).
  1. Make sure the [account](../../../iam/concepts/users/accounts.md) you are using to create a Managed Service for Kubernetes cluster has all the [relevant roles](../../security/index.md#required-roles).
  1. Make sure you have enough [resources available in the cloud](../../concepts/limits.md).
  1. If you do not have a [network](../../../vpc/concepts/network.md#network) yet, [create one](../../../vpc/operations/network-create.md).
  1. If you do not have any [subnets](../../../vpc/concepts/network.md#subnet) yet, [create them](../../../vpc/operations/subnet-create.md) in the [availability zones](../../../overview/concepts/geo-scope.md) where the new Managed Service for Kubernetes cluster and [node group](../../concepts/index.md#node-group) will reside.
  1. Create these [service accounts](../../../iam/operations/sa/create.md):
      * Service account with the `k8s.clusters.agent` and `vpc.publicAdmin` [roles](../../security/index.md#yc-api) for the folder where you want to create a Managed Service for Kubernetes cluster. This service account will be used to create Managed Service for Kubernetes cluster resources.
      * Service account with the [container-registry.images.puller](../../../container-registry/security/index.md#container-registry-images-puller) role for the folder containing the [Docker image](../../../container-registry/concepts/docker-image.md) registry in [Yandex Container Registry](../../../container-registry/concepts/index.md). Nodes will use this account to pull the required Docker images from the registry.

        If you want to use a [Docker image](../../../cloud-registry/concepts/artifacts/docker.md) registry in [Yandex Cloud Registry](../../../cloud-registry/concepts/index.md), assign the [cloud-registry.artifacts.puller](../../../cloud-registry/security/index.md#cloud-registry-artifacts-puller) role to the service account.

      You can use the same service account for both operations.

      {% note info %}
      
      To create a cluster with [tunnel mode](../../concepts/network-policy.md#cilium), its service account requires the `k8s.tunnelClusters.agent` role.
      
      {% endnote %}

  1. [Create and configure the security groups](../connect/security-groups.md).

  1. Check the [recommendations on using Managed Service for Kubernetes](../../concepts/usage-recommendations.md).

{% endlist %}

## Create a Managed Service for Kubernetes cluster {#kubernetes-cluster-create}

{% note warning %}

Starting June 18, 2026, master node pricing has changed, with fees now based on the number of vCPUs and the amount of RAM. Use [this table](../../concepts/master-configuration.md) to estimate the required master node resources for your cluster.

{% endnote %}

{% note warning %}

Starting with Kubernetes 1.30, the Managed Service for Kubernetes cluster node base image changed from Ubuntu 20.04 to Ubuntu 22.04 in all [release channels](../../concepts/release-channels-and-updates.md). In the existing clusters and node groups, the OS version will be upgraded using the method you select.

For OS upgrade details and recommendations, see [Updating node group OS](../../concepts/node-os-update.md).

{% endnote %}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to create a [Managed Service for Kubernetes cluster](../../concepts/index.md#kubernetes-cluster).
  1. Navigate to **Managed Service for Kubernetes**.
  1. Click **Create cluster**.
  1. Enter a name and description for your Managed Service for Kubernetes cluster. The Managed Service for Kubernetes cluster name must be unique within Yandex Cloud.
  1. Specify a **Service account for resources** to use to create your resources.
  1. Specify the **Service account for nodes** the [Managed Service for Kubernetes nodes](../../concepts/index.md#node-group) will use to access the [Docker image](../../../container-registry/concepts/docker-image.md) registry in Yandex Container Registry.
  1. Optionally, specify the **Encryption key** for [secret encryption](../../concepts/encryption.md).
  
     You will not be able to edit this setting once you create a cluster.
  
  1. Specify the [release channel](../../concepts/release-channels-and-updates.md).
  
     You will not be able to edit this setting once you create a cluster.
  
  1. Add [cloud labels](../../concepts/index.md#cluster-labels) in the **Labels** field.
  
  1. Under **Master configuration**:
     * Optionally, expand the **Compute resources** section and select a [resource configuration](../../concepts/index.md#master-resources) for the master.
  
       The selected configuration allocates minimum resources to the master. Depending on the load, the amount of RAM and number of vCPUs will increase automatically.
  
       _By default_, the following resources are provided for the operation of one master host:
       * [Platform](../../../compute/concepts/vm-platforms.md): Intel Cascade Lake
       * Guaranteed vCPU share: 100%
       * vCPU: 2
       * RAM: 8 GB
  
     * In the **Kubernetes version** field, select the Kubernetes version to install on the [Managed Service for Kubernetes master](../../concepts/index.md#master).
     * In the **Public address** field, select an [IP address](../../../vpc/concepts/address.md) assignment method:
       * `Auto`: Assign a random IP address from the Yandex Cloud IP address pool.
       * `No address`: Do not assign a public IP address.
  
       {% note warning %}
       
       Do not place a cluster with a public IP address in subnets with internet access via a [NAT instance](../../../tutorials/routing/nat-instance/index.md). In this case, your request to the cluster’s public IP address will get a response from the NAT instance’s IP address, and the client will reject it. For more information, see [Route priority in complex scenarios](../../../vpc/concepts/routing.md#priority).
       
       {% endnote %}
  
       You will not be able to edit this setting once you create a cluster.
  
     * In the **Type of master** field, select the Managed Service for Kubernetes master type:
       * `Base`: Contains one master host in a single availability zone. Such a master is generally cheaper but it does not guarantee high availability.
  
       * `Highly available`: Contains three master hosts.
  
     * In the **Cloud network** field, select the [network](../../../vpc/concepts/network.md#network) to create a Managed Service for Kubernetes master in. If you do not have a network yet, [create one](../../../vpc/operations/network-create.md).
  
        If you select a [cloud network](../../../vpc/concepts/network.md#network) from another [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder), [assign](../../../iam/operations/sa/assign-role-for-sa.md) the resource [service account](../../../iam/concepts/users/service-accounts.md) the following [roles](../../../iam/concepts/access-control/roles.md) in that folder:
        * [vpc.privateAdmin](../../../vpc/security/index.md#vpc-private-admin)
        * [vpc.user](../../../vpc/security/index.md#vpc-user)
        * [vpc.bridgeAdmin](../../../vpc/security/index.md#vpc-bridge-admin)
        
        To use a [public IP address](../../../vpc/concepts/address.md#public-addresses), also [assign](../../../iam/operations/sa/assign-role-for-sa.md) the [vpc.publicAdmin](../../../vpc/security/index.md#vpc-public-admin) role.
  
        {% note warning %}
        
        Do not change or delete Virtual Private Cloud resources used by the Managed Service for Kubernetes cluster. This may cause cluster errors or make it impossible to delete later.
        
        {% endnote %}
  
     * For a highly available master, select the master host placement in the **Distribution of masters across availability zones** field:
       * `One zone`: In one availability zone and one subnet. Choose this type if you want to ensure high availability of the cluster and reduce its internal network latency.
       * `Different zones`: In three different availability zones. This master ensures the best fault tolerance: if one zone becomes unavailable, the master will continue to function.
  
     * Depending on the type of master you select:
       * For a base or highly available master in a single zone, specify the availability zone and subnet. 
       * For a highly available master in different zones, specify subnets in each zone. 
  
       If there are no subnets, [create](../../../vpc/operations/subnet-create.md) them.
  
       {% note warning %}
  
       You cannot change the master type and placement after you create a cluster.
  
       {% endnote %}
  
     * Select [security groups](../../../vpc/concepts/security-groups.md) for the Managed Service for Kubernetes cluster's network traffic.
  
       {% note warning %}
       
       The [configuration of security groups](../connect/security-groups.md) determines performance and availability of the cluster and services running in it.
       
       {% endnote %}
  
  1. Under **Maintenance window settings**:
     * In the **Maintenance frequency / Disable** field, configure the maintenance window:
       * `Disable`: Automatic updates disabled.
       * `Anytime`: Updates allowed at any time.
       * `Daily`: Updates will take place within the time interval specified in the **Maintenance window start time in UTC** field.
       * `Custom`: Updates will take place within the time interval specified in the **Weekly schedule** field.
  1. Under **Cluster network settings**:
     * Optionally, select the [network policy controller](../../concepts/network-policy.md#policy-controllers):
  
       You will not be able to edit this setting once you create a cluster.
  
       {% note warning %}
       
       You cannot enable the Calico network policy controller and the Cilium tunnel mode at the same time.
       
       {% endnote %}
  
       * **Сalico CNI** to use Calico.
       * **Сilium CNI** to use Cilium.
  
     * Specify the **CIDR cluster**, which is a range of IP addresses to allocate [pod](../../concepts/index.md#pod) IP addresses from.
     * Specify the **CIDR services**, which is a range of IP addresses to allocate [service](../../concepts/index.md#service) IP addresses from.
     * Set the subnet mask for the Managed Service for Kubernetes nodes and the maximum number of pods per node.
  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  To create a Managed Service for Kubernetes cluster:

  1. Specify the Managed Service for Kubernetes cluster parameters in the create command (not all parameters are given in the example):

     ```bash
     yc managed-kubernetes cluster create \
       --name <cluster_name> \
       --network-name <network_name> \
       --public-ip \
       --release-channel <release_channel:_rapid,_regular,_or_stable> \
       --version <Kubernetes_version> \
       --cluster-ipv4-range <IP_address_range_for_pods> \
       --service-ipv4-range <IP_address_range_for_services> \
       --security-group-ids <list_of_security_group_IDs> \
       --service-account-name <name_of_service_account_for_resources> \
       --node-service-account-name <name_of_service_account_for_nodes> \
       --master-location zone=<availability_zone>,subnet-id=<subnet_name> \
       --master-scale-policy policy=auto,min-resource-preset-id=<master_host_class> \
       --daily-maintenance-window start=22:00,duration=10h
       --labels <cloud_label_name=cloud_label_value>

     ```

     Where:

     * `--name`: Managed Service for Kubernetes cluster name.
     * `--network-name`: [Network name](../../../vpc/concepts/network.md#network).

        If you select a [cloud network](../../../vpc/concepts/network.md#network) from another [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder), [assign](../../../iam/operations/sa/assign-role-for-sa.md) the resource [service account](../../../iam/concepts/users/service-accounts.md) the following [roles](../../../iam/concepts/access-control/roles.md) in that folder:
        * [vpc.privateAdmin](../../../vpc/security/index.md#vpc-private-admin)
        * [vpc.user](../../../vpc/security/index.md#vpc-user)
        * [vpc.bridgeAdmin](../../../vpc/security/index.md#vpc-bridge-admin)
        
        To use a [public IP address](../../../vpc/concepts/address.md#public-addresses), also [assign](../../../iam/operations/sa/assign-role-for-sa.md) the [vpc.publicAdmin](../../../vpc/security/index.md#vpc-public-admin) role.

        {% note warning %}
        
        Do not change or delete Virtual Private Cloud resources used by the Managed Service for Kubernetes cluster. This may cause cluster errors or make it impossible to delete later.
        
        {% endnote %}

     * `--public-ip`: Flag indicating that the Managed Service for Kubernetes cluster needs a [public IP address](../../../vpc/concepts/address.md#public-addresses).

       {% note warning %}
       
       Do not place a cluster with a public IP address in subnets with internet access via a [NAT instance](../../../tutorials/routing/nat-instance/index.md). In this case, your request to the cluster’s public IP address will get a response from the NAT instance’s IP address, and the client will reject it. For more information, see [Route priority in complex scenarios](../../../vpc/concepts/routing.md#priority).
       
       {% endnote %}

       You will not be able to edit this setting once you create a cluster.

     * `--release-channel`: [Release channel](../../concepts/release-channels-and-updates.md#release-channels).

       You will not be able to edit this setting once you create a cluster.

     * `--version`: Kubernetes version. Specify a version available for the selected release channel.
     * `--cluster-ipv4-range`: Range of [IP addresses](../../../vpc/concepts/address.md) for allocating [pod](../../concepts/index.md#pod) addresses.
     * `--service-ipv4-range`: Range of IP addresses for allocating [service](../../concepts/index.md#service) addresses.
     * `--security-group-ids`: List of Managed Service for Kubernetes cluster [security group](../../../vpc/concepts/security-groups.md) IDs.

       {% note warning %}
       
       The [configuration of security groups](../connect/security-groups.md) determines performance and availability of the cluster and services running in it.
       
       {% endnote %}

     * `--service-account-id`: Unique ID of the [service account](../../../iam/concepts/users/service-accounts.md) for the resources. This service account will be used to create Managed Service for Kubernetes cluster resources.
     * `--node-service-account-id`: Unique ID of the service account for the [nodes](../../concepts/index.md#node-group). Nodes will use this account to pull the required [Docker images](../../../container-registry/concepts/docker-image.md) from the [registry](../../../container-registry/concepts/registry.md) in Yandex Container Registry.
     * `--master-location`: [Master](../../concepts/index.md#master) configuration. Specify the availability zone and subnet where the master will reside.

        The number of `--master-location` parameters depends on the type of master:

        * For a base master, provide one `--master-location` parameter.
        * For a highly available master placed across three availability zones, provide three `--master-location` parameters. In each one, specify different availability zones and subnets.
        * For a highly available master placed in a single availability zone, provide three `--master-location` parameters. In each one, specify the same availability zone and subnet.

     * `--master-scale-policy`: [Master's computing resource](../../concepts/index.md#master-resources) configuration.

        The selected configuration allocates minimum resources to the master. Depending on the load, the amount of RAM and number of vCPUs will increase automatically.

        {% note info %}

        If you do not provide the `--master-scale-policy` parameter, the minimum available master configuration will be applied.

        _By default_, the following resources are provided for the operation of one master host:
        * [Platform](../../../compute/concepts/vm-platforms.md): Intel Cascade Lake
        * Guaranteed vCPU share: 100%
        * vCPU: 2
        * RAM: 8 GB

        {% endnote %}

     * `--daily-maintenance-window`: Settings for the [update](../../concepts/release-channels-and-updates.md#updates) window start time in UTC.
     * `--labels`: [Cloud labels](../../concepts/index.md#cluster-labels) for the cluster.

     Result:

     ```text
     done (5m47s)
     id: cathn0s6qobf********
     folder_id: b1g66jflru0e********
     ...
       service_account_id: aje3932acd0c********
       node_service_account_id: aje3932acd0c********
       release_channel: REGULAR
     ```
  
  1. Configure the [container network interface](https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) for your cluster:

      You will not be able to edit this setting once you create a cluster.

      {% note warning %}
      
      You cannot enable the Calico network policy controller and the Cilium tunnel mode at the same time.
      
      {% endnote %}

      * To enable the Calico [network policy controller](../../concepts/network-policy.md#calico), set the `--enable-network-policy` flag in the Managed Service for Kubernetes cluster create command:

        ```bash
        yc managed-kubernetes cluster create \
        ...
          --enable-network-policy
        ```

      * To enable [tunnel mode](../../concepts/network-policy.md#cilium) for Cilium, provide the `--cilium` flag in the Managed Service for Kubernetes cluster create command:

        ```bash
        yc managed-kubernetes cluster create \
        ...
          --cilium
        ```

  1. To use the [Yandex Key Management Service encryption key](../../concepts/encryption.md) for protecting sensitive data, provide the key name or ID in the Managed Service for Kubernetes cluster creation command:

     ```bash
     yc managed-kubernetes cluster create \
     ...
       --kms-key-name <encryption_key_name> \
       --kms-key-id <encryption_key_ID>
     ```

     You will not be able to edit this setting once you create a cluster.

  1. To enable sending logs to [Yandex Cloud Logging](../../../logging/index.md):

     1. [Assign](../../../iam/operations/sa/assign-role-for-sa.md) the [logging.writer](../../../logging/security/index.md#loggingwriter) role to the service account for resources.
     1. Provide the logging settings in the `--master-logging` parameter of the cluster create command:

        ```bash
        yc managed-kubernetes cluster create \
        ...
          --master-logging enabled=<send_logs:_true_or_false>,`
            `log-group-id=<log_group_ID>,`
            `folder-id=<folder_ID>,`
            `kube-apiserver-enabled=<send_kube-apiserver_logs:_true_or_false>,`
            `cluster-autoscaler-enabled=<send_cluster-autoscaler_logs:_true_or_false>,`
            `events-enabled=<send_Kubernetes_events:_true_or_false>`
            `audit-enabled=<send_audit_events>`
        ```

        Where:

        * `enabled`: Flag that enables sending logs, `true` or `false`.
        * `log-group-id`: ID of the [log group](../../../logging/concepts/log-group.md) to send logs to.
        * `folder-id`: ID of the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) to send logs to. Logs will be sent to the log group of the default folder.
        * `kube-apiserver-enabled`: Flag that enables sending [kube-apiserver](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/) logs, `true` or `false`.
        * `cluster-autoscaler-enabled`: Flag that enables sending `cluster-autoscaler` logs, `true` or `false`.
        * `events-enabled`: Flag that enables sending Kubernetes events, `true` or `false`.
        * `audit-enabled`: Flag that enables sending audit events, `true` or `false`.

        If log sending is enabled but neither `log-group-id` nor `folder-id` is specified, logs will be sent to the default log group in the [Managed Service for Kubernetes cluster folder](../../concepts/index.md#kubernetes-cluster). You cannot specify both `log-group-id` and `folder-id` at the same time.

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  To create a Managed Service for Kubernetes cluster:
  1. In the configuration file, describe the resources you want to create:
     * Managed Service for Kubernetes cluster: Cluster description.
     * [Network](../../../vpc/concepts/network.md#network): Description of the cloud network to host the Managed Service for Kubernetes cluster. If you already have a network in place, you do not need to describe it again.

        If you select a [cloud network](../../../vpc/concepts/network.md#network) from another [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder), [assign](../../../iam/operations/sa/assign-role-for-sa.md) the resource [service account](../../../iam/concepts/users/service-accounts.md) the following [roles](../../../iam/concepts/access-control/roles.md) in that folder:
        * [vpc.privateAdmin](../../../vpc/security/index.md#vpc-private-admin)
        * [vpc.user](../../../vpc/security/index.md#vpc-user)
        * [vpc.bridgeAdmin](../../../vpc/security/index.md#vpc-bridge-admin)
        
        To use a [public IP address](../../../vpc/concepts/address.md#public-addresses), also [assign](../../../iam/operations/sa/assign-role-for-sa.md) the [vpc.publicAdmin](../../../vpc/security/index.md#vpc-public-admin) role.

     * [Subnets](../../../vpc/concepts/network.md#subnet): Description of the subnets to connect the Managed Service for Kubernetes cluster hosts to. If you already have suitable subnets, you do not need to describe them again.

         {% note warning %}
         
         Do not change or delete Virtual Private Cloud resources used by the Managed Service for Kubernetes cluster. This may cause cluster errors or make it impossible to delete later.
         
         {% endnote %}

     * [Service account](#before-you-begin) for the Managed Service for Kubernetes cluster and [nodes](../../concepts/index.md#node-group) and [role settings](../../../terraform/resources/resourcemanager_folder_iam_member.md) for this account. Create separate [service accounts](../../../iam/concepts/users/service-accounts.md) for the Managed Service for Kubernetes cluster and nodes, as required. If you already have a suitable service account, you do not need to describe it again.

     >Here is an example of the configuration file structure:
     >
     >```hcl
     >resource "yandex_kubernetes_cluster" "<Managed_Service_for_Kubernetes_cluster_name>" {
     >  network_id = yandex_vpc_network.<network_name>.id
     >  master {
     >    master_location {
     >      zone      = yandex_vpc_subnet.<subnet_name>.zone
     >      subnet_id = yandex_vpc_subnet.<subnet_name>.id
     >    }
     >  }
     >  service_account_id      = yandex_iam_service_account.<service_account_name>.id
     >  node_service_account_id = yandex_iam_service_account.<service_account_name>.id
     >    depends_on = [
     >      yandex_resourcemanager_folder_iam_member.k8s-clusters-agent,
     >      yandex_resourcemanager_folder_iam_member.vpc-public-admin,
     >      yandex_resourcemanager_folder_iam_member.images-puller
     >    ]
     > }
     >  labels {
     >    "<cloud_label_name>"="<cloud_label_value>"
     >  }
     >resource "yandex_vpc_network" "<network_name>" { name = "<network_name>" }
     >
     >resource "yandex_vpc_subnet" "<subnet_name>" {
     >  v4_cidr_blocks = ["<subnet_IP_address_range>"]
     >  zone           = "<availability_zone>"
     >  network_id     = yandex_vpc_network.<network_name>.id
     >}
     >
     >resource "yandex_iam_service_account" "<service_account_name>" {
     >  name        = "<service_account_name>"
     >  description = "<service_account_description>"
     >}
     >
     >resource "yandex_resourcemanager_folder_iam_member" "k8s-clusters-agent" {
     >  # The service account gets the "k8s.clusters.agent" role.
     >  folder_id = "<folder_ID>"
     >  role      = "k8s.clusters.agent"
     >  member    = "serviceAccount:${yandex_iam_service_account.<service_account_name>.id}"
     >}
     >
     >resource "yandex_resourcemanager_folder_iam_member" "vpc-public-admin" {
     >  # The service account gets the "vpc.publicAdmin" role.
     >  folder_id = "<folder_ID>"
     >  role      = "vpc.publicAdmin"
     >  member    = "serviceAccount:${yandex_iam_service_account.<service_account_name>.id}"
     >}
     >
     >resource "yandex_resourcemanager_folder_iam_member" "images-puller" {
     >  # The service account gets the "container-registry.images.puller" role.
     >  folder_id = "<folder_ID>"
     >  role      = "container-registry.images.puller"
     >  member    = "serviceAccount:${yandex_iam_service_account.<service_account_name>.id}"
     >}
     >```

     {% note info %}

     Cloud labels for a Kubernetes cluster are composed according to certain [rules](../../concepts/index.md#cluster-labels).

     {% endnote %}

     To configure the [master's computing resources](../../concepts/index.md#master-resources), add the following section to the Managed Service for Kubernetes cluster description:

     >```hcl
     >resource "yandex_kubernetes_cluster" "<cluster_name>" {
     >  ...
     >  master {
     >    ...
     >    scale_policy {
     >      auto_scale  {
     >        min_resource_preset_id = "<master_host_class>"
     >      }
     >    }
     >  }
     >}
     >```

     The selected configuration allocates minimum resources to the master. Depending on the load, the amount of RAM and number of vCPUs will increase automatically.

     {% note info %}

     If you do not provide the `scale_policy` parameter, the minimum available master configuration will be applied.

     _By default_, the following resources are provided for the operation of one master host:
     * [Platform](../../../compute/concepts/vm-platforms.md): Intel Cascade Lake
     * Guaranteed vCPU share: 100%
     * vCPU: 2
     * RAM: 8 GB

     {% endnote %}

     To enable the Cilium [tunnel mode](../../concepts/network-policy.md#cilium), add the following section to the Managed Service for Kubernetes cluster description:

     ```hcl
     network_implementation {
      cilium {}
     }
     ```

     To enable the Calico [network policy controller](../../concepts/network-policy.md#calico), add the following line to the Managed Service for Kubernetes cluster description:

     ```hcl
     network_policy_provider = "CALICO"
     ```

     {% note warning %}

     You cannot enable the Calico network policy controller and the Cilium tunnel mode at the same time. You cannot enable them after creating a cluster either.

     {% endnote %}

     To enable sending logs to [Yandex Cloud Logging](../../../logging/index.md):

     1. [Assign](../../../iam/operations/sa/assign-role-for-sa.md) the [logging.writer](../../../logging/security/index.md#loggingwriter) role to the service account for resources.
     1. Add the `master_logging` section to the Managed Service for Kubernetes cluster description:

        >```hcl
        >resource "yandex_kubernetes_cluster" "<cluster_name>" {
        >  ...
        >  master {
        >    ...
        >    master_logging {
        >      enabled                    = <send_logs>
        >      log_group_id               = "<log_group_ID>"
        >      folder_id                  = "<folder_ID>"
        >      kube_apiserver_enabled     = <send_kube-apiserver_logs>
        >      cluster_autoscaler_enabled = <send_cluster-autoscaler_logs>
        >      events_enabled             = <send_Kubernetes_events>
        >      audit_enabled              = <send_audit_events>
        >    }
        >  }
        >}
        >```

        Where:

        * `enabled`: Flag that enables sending logs, `true` or `false`.
        * `log_group_id`: ID of the [log group](../../../logging/concepts/log-group.md) to send logs to.
        * `folder_id`: ID of the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) to send logs to. Logs will be sent to the log group of the default folder.
        * `kube_apiserver_enabled`: Flag that enables sending [kube-apiserver](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/) logs, `true` or `false`.
        * `cluster_autoscaler_enabled`: Flag that enables sending `cluster-autoscaler` logs, `true` or `false`.
        * `events_enabled`: Flag that enables sending Kubernetes events, `true` or `false`.
        * `audit_enabled`: Flag that enables sending audit events, `true` or `false`.

        If log sending is enabled but neither `log-group-id` nor `folder-id` is specified, logs will be sent to the default log group in the [Managed Service for Kubernetes cluster folder](../../concepts/index.md#kubernetes-cluster). You cannot specify both `log-group-id` and `folder-id` at the same time.

     For more information, see [this Terraform provider guide](../../../terraform/resources/kubernetes_cluster.md).
  1. Make sure the configuration files are correct.

     1. In the command line, go to the folder where you created the configuration file.
     
     1. Run a check using this command:
     
        ```bash
        terraform plan
        ```
     
     If the configuration is described correctly, the terminal will display a list of created resources and their parameters. If the configuration contains any errors, Terraform will point them out. This is a test step; no resources will be created.

  1. Create a Managed Service for Kubernetes cluster.

     1. If the configuration does not contain any errors, run this command:
     
        ```bash
        terraform apply
        ```
     
     1. Confirm that you want to create the resources.
     
     After this, all required resources will be created in the specified folder and the IP addresses of the VMs will be displayed in the terminal. You can check the new resources and their configuration using the [management console](https://console.yandex.cloud).

     {% note warning "Timeouts" %}
     
     The Terraform provider limits the time for creating and updating a Managed Service for Kubernetes cluster to 30 minutes.
     
     Operations in excess of this time will be interrupted.
     
     {% cut "How do I modify these limits?" %}
     
     Add a `timeouts` block to the cluster description, e.g.:
     
     ```hcl
     resource "yandex_kubernetes_cluster" "<cluster_name>" {
       ...
       timeouts {
         create = "60m"
         update = "60m"
       }
     }
     ```
     
     {% endcut %}
     
     {% endnote %}

- API {#api}

  To create a Managed Service for Kubernetes cluster, use the [create](../../managed-kubernetes/api-ref/Cluster/create.md) REST API method for the [Cluster](../../managed-kubernetes/api-ref/Cluster/index.md) resource or the [ClusterService/Create](../../managed-kubernetes/api-ref/grpc/Cluster/create.md) gRPC API call.

  {% note info %}
  
  Below, see parameters for the REST API request body. To specify a parameter in a gRPC API call, convert its name from [lower CamelCase](https://en.wikipedia.org/wiki/Camel_case) to [snake_case](https://en.wikipedia.org/wiki/Snake_case), e.g., `minResourcePresetId` becomes `min_resource_preset_id`.
  
  {% endnote %}

  The request body depends on the [master type](../../concepts/index.md#master):

  * For a base master, provide one `masterSpec.locations` parameter in the request.
  * For a highly available master placed across three availability zones, provide three `masterSpec.locations` parameters in the request. In each one, specify different availability zones and subnets.
  * For a highly available master placed in a single availability zone, provide three `masterSpec.locations` parameters in the request. In each one, specify the same availability zone and subnet.

  {% note warning %}
  
  Do not change or delete Virtual Private Cloud resources used by the Managed Service for Kubernetes cluster. This may cause cluster errors or make it impossible to delete later.
  
  {% endnote %}

  If you select a [cloud network](../../../vpc/concepts/network.md#network) from another [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder), [assign](../../../iam/operations/sa/assign-role-for-sa.md) the resource [service account](../../../iam/concepts/users/service-accounts.md) the following [roles](../../../iam/concepts/access-control/roles.md) in that folder:
  * [vpc.privateAdmin](../../../vpc/security/index.md#vpc-private-admin)
  * [vpc.user](../../../vpc/security/index.md#vpc-user)
  * [vpc.bridgeAdmin](../../../vpc/security/index.md#vpc-bridge-admin)
  
  To use a [public IP address](../../../vpc/concepts/address.md#public-addresses), also [assign](../../../iam/operations/sa/assign-role-for-sa.md) the [vpc.publicAdmin](../../../vpc/security/index.md#vpc-public-admin) role.

  When providing the `masterSpec.locations` parameter, you do not need to specify `masterSpec.zonalMasterSpec` or `masterSpec.regionalMasterSpec`.

  To specify the [master's computing resource configuration](../../concepts/index.md#master-resources), provide its value in `masterSpec.scalePolicy.autoScale.minResourcePresetId`.

  The selected configuration allocates minimum resources to the master. Depending on the load, the amount of RAM and number of vCPUs will increase automatically.

  {% note info %}

  If you do not provide the `masterSpec.scalePolicy` parameter, the minimum available master configuration will be applied.

  _By default_, the following resources are provided for the operation of one master host:
  * [Platform](../../../compute/concepts/vm-platforms.md): Intel Cascade Lake
  * Guaranteed vCPU share: 100%
  * vCPU: 2
  * RAM: 8 GB

  {% endnote %}

  To use a [Yandex Key Management Service encryption key](../../concepts/encryption.md) to protect secrets, provide its ID in the `kmsProvider.keyId` parameter.

  To enable sending logs to [Yandex Cloud Logging](../../../logging/index.md), [assign](../../../iam/operations/sa/assign-role-for-sa.md) the [logging.writer](../../../logging/security/index.md#loggingwriter) role to the service account you use for accessing resources and provide the logging settings in the `masterSpec.masterLogging` parameter.

  To add a [cloud label](../../concepts/index.md#cluster-labels), provide its name and value in the `labels` parameter.

{% endlist %}

## Examples {#examples}

### Creating a Managed Service for Kubernetes cluster with a base master {#example-single-cluster}

{% list tabs group=instructions %}

- CLI {#cli}

  Create a Managed Service for Kubernetes cluster with the following test specifications:

  * Name: `k8s-single`.
  * Network: `mynet`.
  * Availability zone: `ru-central1-a`.
  * Subnet: `mysubnet`.
  * Service account: `myaccount`.
  * Security group ID: `enp6saqnq4ie244g67sb`.

  To create a Managed Service for Kubernetes cluster with a base master, run this command:

  ```bash
  yc managed-kubernetes cluster create \
     --name k8s-single \
     --network-name mynet \
     --master-location zone=ru-central1-a,subnet-name=mysubnet \
     --service-account-name myaccount \
     --node-service-account-name myaccount \
     --security-group-ids enp6saqnq4ie244g67sb
  ```

- Terraform {#tf}

  Create a Managed Service for Kubernetes cluster and its network with the following test specifications:

  * Name: `k8s-single`.
  * [Folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) ID: `b1gia87mbaomkfvsleds`.
  * Network: `mynet`.
  * Subnet: `mysubnet`. Its network settings are as follows:

    * Availability zone: `ru-central1-a`.
    * Range: `10.1.0.0/16`.

  * Service account: `myaccount`.
  * Service account [roles](../../../iam/concepts/access-control/roles.md): `k8s.clusters.agent`, `vpc.publicAdmin`, `container-registry.images.puller`, and `kms.keys.encrypterDecrypter`.
  * Yandex Key Management Service [encryption key](../../concepts/encryption.md): `kms-key`.
  * Security group: `k8s-public-services`. It contains [rules for connecting to services from the internet](../connect/security-groups.md#rules-nodes).

  Install Terraform (unless you already have it), configure the provider according to [this guide](../../../tutorials/infrastructure-management/terraform-quickstart.md#configure-provider), and apply the configuration file:

  ```hcl
  locals {
    folder_id   = "b1gia87mbaomkfvsleds"
  }

  resource "yandex_kubernetes_cluster" "k8s-single" {
    name = "k8s-single"
    network_id = yandex_vpc_network.mynet.id
    master {
      master_location {
        zone      = yandex_vpc_subnet.mysubnet.zone
        subnet_id = yandex_vpc_subnet.mysubnet.id
      }
      security_group_ids = [yandex_vpc_security_group.k8s-public-services.id]
    }
    service_account_id      = yandex_iam_service_account.myaccount.id
    node_service_account_id = yandex_iam_service_account.myaccount.id
    depends_on = [
      yandex_resourcemanager_folder_iam_member.k8s-clusters-agent,
      yandex_resourcemanager_folder_iam_member.vpc-public-admin,
      yandex_resourcemanager_folder_iam_member.images-puller,
      yandex_resourcemanager_folder_iam_member.encrypterDecrypter
    ]
    kms_provider {
      key_id = yandex_kms_symmetric_key.kms-key.id
    }
  }

  resource "yandex_vpc_network" "mynet" {
    name = "mynet"
  }

  resource "yandex_vpc_subnet" "mysubnet" {
    name = "mysubnet"
    v4_cidr_blocks = ["10.1.0.0/16"]
    zone           = "ru-central1-a"
    network_id     = yandex_vpc_network.mynet.id
  }

  resource "yandex_iam_service_account" "myaccount" {
    name        = "myaccount"
    description = "Service account for the single Kubernetes cluster"
  }

  resource "yandex_resourcemanager_folder_iam_member" "k8s-clusters-agent" {
    # The service account gets the "k8s.clusters.agent" role.
    folder_id = local.folder_id
    role      = "k8s.clusters.agent"
    member    = "serviceAccount:${yandex_iam_service_account.myaccount.id}"
  }

  resource "yandex_resourcemanager_folder_iam_member" "vpc-public-admin" {
    # The service account gets the "vpc.publicAdmin" role.
    folder_id = local.folder_id
    role      = "vpc.publicAdmin"
    member    = "serviceAccount:${yandex_iam_service_account.myaccount.id}"
  }

  resource "yandex_resourcemanager_folder_iam_member" "images-puller" {
    # The service account gets the "container-registry.images.puller" role.
    folder_id = local.folder_id
    role      = "container-registry.images.puller"
    member    = "serviceAccount:${yandex_iam_service_account.myaccount.id}"
  }

  resource "yandex_resourcemanager_folder_iam_member" "encrypterDecrypter" {
    # The service account gets the "kms.keys.encrypterDecrypter" role.
    folder_id = local.folder_id
    role      = "kms.keys.encrypterDecrypter"
    member    = "serviceAccount:${yandex_iam_service_account.myaccount.id}"
  }

  resource "yandex_kms_symmetric_key" "kms-key" {
    # Yandex Key Management Service key for encryption of critical information, such as passwords and SSH keys.
    name              = "kms-key"
    default_algorithm = "AES_128"
    rotation_period   = "8760h" # 1 year.
  }

  resource "yandex_vpc_security_group" "k8s-public-services" {
    name        = "k8s-public-services"
    description = "The group rules allow connections to services from the internet. Apply the rules for node groups only."
    network_id  = yandex_vpc_network.mynet.id
    ingress {
      protocol          = "TCP"
      description       = "The rule allows availability checks from the load balancer's range of addresses. It is required for a fault-tolerant Managed Service for Kubernetes cluster and load balancer services."
      predefined_target = "loadbalancer_healthchecks"
      from_port         = 0
      to_port           = 65535
    }
    ingress {
      protocol          = "ANY"
      description       = "The rule allows master-to-node and node-to-node interactions inside a security group."
      predefined_target = "self_security_group"
      from_port         = 0
      to_port           = 65535
    }
    ingress {
      protocol          = "ANY"
      description       = "The rule allows pod-to-pod and service-to-service interactions. Specify the subnets of your Managed Service for Kubernetes cluster and services."
      v4_cidr_blocks    = concat(yandex_vpc_subnet.mysubnet.v4_cidr_blocks)
      from_port         = 0
      to_port           = 65535
    }
    ingress {
      protocol          = "ICMP"
      description       = "The rule allows debug ICMP packets from internal subnets."
      v4_cidr_blocks    = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
    }
    ingress {
      protocol          = "TCP"
      description       = "The rule allows incoming traffic from the internet to a range of NodePorts. Add ports or replace the existing ones as required."
      v4_cidr_blocks    = ["0.0.0.0/0"]
      from_port         = 30000
      to_port           = 32767
    }
    egress {
      protocol          = "ANY"
      description       = "The rule allows all outgoing traffic. Nodes can connect to Yandex Container Registry, Yandex Object Storage, Docker Hub, etc."
      v4_cidr_blocks    = ["0.0.0.0/0"]
      from_port         = 0
      to_port           = 65535
    }
  }
  ```

{% endlist %}

### Creating a Managed Service for Kubernetes cluster with a highly available master in three availability zones {#example-ha-cluster-three-zones}

{% list tabs group=instructions %}

- CLI {#cli}

  Create a Managed Service for Kubernetes cluster with the following test specifications:
  * Name: `k8s-ha-three-zones`.
  * Network: `my-ha-net`.
  * Subnet for the `ru-central1-a` availability zone: `mysubnet-a`.
  * Subnet for the `ru-central1-b` availability zone: `mysubnet-b`.
  * Subnet for the `ru-central1-d` availability zone: `mysubnet-d`.
  * Service account: `ha-k8s-account`.
  * Security group ID: `enp6saqnq4ie244g67sb`.

  To create a Managed Service for Kubernetes cluster with a highly available master in three availability zones, run this command:

  ```bash
  yc managed-kubernetes cluster create \
     --name k8s-ha-three-zones \
     --network-name my-ha-net \
     --master-location zone=ru-central1-a,subnet-name=mysubnet-a \
     --master-location zone=ru-central1-b,subnet-name=mysubnet-b \
     --master-location zone=ru-central1-d,subnet-name=mysubnet-d \
     --service-account-name ha-k8s-account \
     --node-service-account-name ha-k8s-account \
     --security-group-ids enp6saqnq4ie244g67sb
  ```

- Terraform {#tf}

  Create a Managed Service for Kubernetes cluster and its supporting network, using the following test specifications:

  * Name: `k8s-ha-three-zones`.
  * Folder ID: `b1gia87mbaomkfvsleds`.
  * Network: `my-ha-net`.
  * Subnet: `mysubnet-a`. Its network settings are as follows:

    * Availability zone: `ru-central1-a`.
    * Range: `10.5.0.0/16`.

  * Subnet: `mysubnet-b`. Its network settings are as follows:

    * Availability zone: `ru-central1-b`.
    * Range: `10.6.0.0/16`.

  * Subnet: `mysubnet-d`. Its network settings are as follows:

    * Availability zone: `ru-central1-d`.
    * Range: `10.7.0.0/16`.

  * Service account: `ha-k8s-account`.
  * Service account roles: `k8s.clusters.agent`, `vpc.publicAdmin`, `container-registry.images.puller`, and `kms.keys.encrypterDecrypter`.
  * Yandex Key Management Service [encryption key](../../concepts/encryption.md): `kms-key`.
  * Security group: `regional-k8s-sg`. It contains [rules for service traffic](../connect/security-groups.md#rules-internal).

  Install Terraform (unless you already have it), configure the provider according to [this guide](../../../tutorials/infrastructure-management/terraform-quickstart.md#configure-provider), and apply the configuration file:

  ```hcl
  locals {
    folder_id   = "b1gia87mbaomkfvsleds"
  }

  resource "yandex_kubernetes_cluster" "k8s-ha-three-zones" {
    name = "k8s-ha-three-zones"
    network_id = yandex_vpc_network.my-ha-net.id
    master {
      master_location {
        zone      = yandex_vpc_subnet.mysubnet-a.zone
        subnet_id = yandex_vpc_subnet.mysubnet-a.id
      }
      master_location {
        zone      = yandex_vpc_subnet.mysubnet-b.zone
        subnet_id = yandex_vpc_subnet.mysubnet-b.id
      }
      master_location {
        zone      = yandex_vpc_subnet.mysubnet-d.zone
        subnet_id = yandex_vpc_subnet.mysubnet-d.id
      }
      security_group_ids = [yandex_vpc_security_group.ha-k8s-sg.id]
    }
    service_account_id      = yandex_iam_service_account.ha-k8s-account.id
    node_service_account_id = yandex_iam_service_account.ha-k8s-account.id
    depends_on = [
      yandex_resourcemanager_folder_iam_member.k8s-clusters-agent,
      yandex_resourcemanager_folder_iam_member.vpc-public-admin,
      yandex_resourcemanager_folder_iam_member.images-puller,
      yandex_resourcemanager_folder_iam_member.encrypterDecrypter
    ]
    kms_provider {
      key_id = yandex_kms_symmetric_key.kms-key.id
    }
  }

  resource "yandex_vpc_network" "my-ha-net" {
    name = "my-ha-net"
  }

  resource "yandex_vpc_subnet" "mysubnet-a" {
    name = "mysubnet-a"
    v4_cidr_blocks = ["10.5.0.0/16"]
    zone           = "ru-central1-a"
    network_id     = yandex_vpc_network.my-ha-net.id
  }

  resource "yandex_vpc_subnet" "mysubnet-b" {
    name = "mysubnet-b"
    v4_cidr_blocks = ["10.6.0.0/16"]
    zone           = "ru-central1-b"
    network_id     = yandex_vpc_network.my-ha-net.id
  }

  resource "yandex_vpc_subnet" "mysubnet-d" {
    name = "mysubnet-d"
    v4_cidr_blocks = ["10.7.0.0/16"]
    zone           = "ru-central1-d"
    network_id     = yandex_vpc_network.my-ha-net.id
  }

  resource "yandex_iam_service_account" "ha-k8s-account" {
    name        = "ha-k8s-account"
    description = "Service account for the highly available Kubernetes cluster"
  }

  resource "yandex_resourcemanager_folder_iam_member" "k8s-clusters-agent" {
    # The service account gets the "k8s.clusters.agent" role.
    folder_id = local.folder_id
    role      = "k8s.clusters.agent"
    member    = "serviceAccount:${yandex_iam_service_account.ha-k8s-account.id}"
  }

  resource "yandex_resourcemanager_folder_iam_member" "vpc-public-admin" {
    # The service account gets the "vpc.publicAdmin" role.
    folder_id = local.folder_id
    role      = "vpc.publicAdmin"
    member    = "serviceAccount:${yandex_iam_service_account.ha-k8s-account.id}"
  }

  resource "yandex_resourcemanager_folder_iam_member" "images-puller" {
    # The service account gets the "container-registry.images.puller" role.
    folder_id = local.folder_id
    role      = "container-registry.images.puller"
    member    = "serviceAccount:${yandex_iam_service_account.ha-k8s-account.id}"
  }

  resource "yandex_resourcemanager_folder_iam_member" "encrypterDecrypter" {
    # The service account gets the "kms.keys.encrypterDecrypter" role.
    folder_id = local.folder_id
    role      = "kms.keys.encrypterDecrypter"
    member    = "serviceAccount:${yandex_iam_service_account.ha-k8s-account.id}"
  }

  resource "yandex_kms_symmetric_key" "kms-key" {
    # Yandex Key Management Service key for encryption of critical information, such as passwords and SSH keys.
    name              = "kms-key"
    default_algorithm = "AES_128"
    rotation_period   = "8760h" # 1 year.
  }

  resource "yandex_vpc_security_group" "ha-k8s-sg" {
    name        = "ha-k8s-sg"
    description = "The group rules ensure the basic performance of the Managed Service for Kubernetes cluster. Apply them to the cluster and node groups."
    network_id  = yandex_vpc_network.my-ha-net.id
    ingress {
      protocol          = "TCP"
      description       = "The rule allows availability checks from the load balancer's range of addresses. It is required for a fault-tolerant Managed Service for Kubernetes cluster and load balancer services."
      predefined_target = "loadbalancer_healthchecks"
      from_port         = 0
      to_port           = 65535
    }
    ingress {
      protocol          = "ANY"
      description       = "The rule allows master-to-node and node-to-node interactions inside a security group."
      predefined_target = "self_security_group"
      from_port         = 0
      to_port           = 65535
    }
    ingress {
      protocol          = "ANY"
      description       = "The rule allows pod-to-pod and service-to-service interactions. Specify the subnets of your Managed Service for Kubernetes cluster and services."
      v4_cidr_blocks    = concat(yandex_vpc_subnet.mysubnet-a.v4_cidr_blocks, yandex_vpc_subnet.mysubnet-b.v4_cidr_blocks, yandex_vpc_subnet.mysubnet-d.v4_cidr_blocks)
      from_port         = 0
      to_port           = 65535
    }
    ingress {
      protocol          = "ICMP"
      description       = "The rule allows debug ICMP packets from internal subnets."
      v4_cidr_blocks    = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
    }
    ingress {
      protocol          = "TCP"
      description       = "The rule allows incoming traffic from the internet to a range of NodePorts. Add ports or replace the existing ones as required."
      v4_cidr_blocks    = ["0.0.0.0/0"]
      from_port         = 30000
      to_port           = 32767
    }
    egress {
      protocol          = "ANY"
      description       = "The rule allows all outgoing traffic. Nodes can connect to Yandex Container Registry, Yandex Object Storage, Docker Hub, etc."
      v4_cidr_blocks    = ["0.0.0.0/0"]
      from_port         = 0
      to_port           = 65535
    }
  }
  ```

{% endlist %}

### Creating a Managed Service for Kubernetes cluster with a highly available master in a single availability zone {#example-ha-cluster-one-zone}

{% list tabs group=instructions %}

- CLI {#cli}

  Create a Managed Service for Kubernetes cluster with the following test specifications:

  * Name: `k8s-ha-one-zone`.
  * Network: `my-ha-net`.
  * Subnet for the `ru-central1-a` availability zone: `my-ha-subnet`.
  * Number of identical `--master-location` parameters: three. This creates three instances of the master in one availability zone.
  * Availability zone: `ru-central1-a`.
  * Service account: `ha-k8s-account`.
  * Security group ID: `enp6saqnq4ie244g67sb`.

  To create a Managed Service for Kubernetes cluster with a highly available master in a single availability zone , run this command:

  ```bash
  yc managed-kubernetes cluster create \
     --name k8s-ha-one-zone \
     --network-name my-ha-net \
     --master-location zone=ru-central1-a,subnet-name=my-ha-subnet \
     --master-location zone=ru-central1-a,subnet-name=my-ha-subnet \
     --master-location zone=ru-central1-a,subnet-name=my-ha-subnet \
     --service-account-name ha-k8s-account \
     --node-service-account-name ha-k8s-account \
     --security-group-ids enp6saqnq4ie244g67sb
  ```

- Terraform {#tf}

  Create a Managed Service for Kubernetes cluster and its supporting network, using the following test specifications:

  * Name: `k8s-ha-one-zone`.
  * Folder ID: `b1gia87mbaomkfvsleds`.
  * Network: `my-ha-net`.
  * Subnet: `my-ha-subnet`. Its network settings are as follows:

    * Availability zone: `ru-central1-a`.
    * Range: `10.5.0.0/16`.

  * Service account: `ha-k8s-account`.
  * Service account roles: `k8s.clusters.agent`, `vpc.publicAdmin`, `container-registry.images.puller`, and `kms.keys.encrypterDecrypter`.
  * Yandex Key Management Service encryption key: `kms-key`.
  * Security group: `ha-k8s-sg`. It contains [rules for service traffic](../connect/security-groups.md#rules-internal).

  Install Terraform (unless you already have it), configure the provider according to [this guide](../../../tutorials/infrastructure-management/terraform-quickstart.md#configure-provider), and apply the configuration file:

  ```hcl
  locals {
    folder_id   = "b1gia87mbaomkfvsleds"
  }

  resource "yandex_kubernetes_cluster" "k8s-ha-one-zone" {
    name = "k8s-ha-one-zone"
    network_id = yandex_vpc_network.my-ha-net.id
    master {
      master_location {
        zone      = yandex_vpc_subnet.my-ha-subnet.zone
        subnet_id = yandex_vpc_subnet.my-ha-subnet.id
      }
      master_location {
        zone      = yandex_vpc_subnet.my-ha-subnet.zone
        subnet_id = yandex_vpc_subnet.my-ha-subnet.id
      }
      master_location {
        zone      = yandex_vpc_subnet.my-ha-subnet.zone
        subnet_id = yandex_vpc_subnet.my-ha-subnet.id
      }
      security_group_ids = [yandex_vpc_security_group.ha-k8s-sg.id]
    }
    service_account_id      = yandex_iam_service_account.ha-k8s-account.id
    node_service_account_id = yandex_iam_service_account.ha-k8s-account.id
    depends_on = [
      yandex_resourcemanager_folder_iam_member.k8s-clusters-agent,
      yandex_resourcemanager_folder_iam_member.vpc-public-admin,
      yandex_resourcemanager_folder_iam_member.images-puller,
      yandex_resourcemanager_folder_iam_member.encrypterDecrypter
    ]
    kms_provider {
      key_id = yandex_kms_symmetric_key.kms-key.id
    }
  }

  resource "yandex_vpc_network" "my-ha-net" {
    name = "my-ha-net"
  }

  resource "yandex_vpc_subnet" "my-ha-subnet" {
    name = "my-ha-subnet"
    v4_cidr_blocks = ["10.5.0.0/16"]
    zone           = "ru-central1-a"
    network_id     = yandex_vpc_network.my-ha-net.id
  }

  resource "yandex_iam_service_account" "ha-k8s-account" {
    name        = "ha-k8s-account"
    description = "Service account for the highly available Kubernetes cluster"
  }

  resource "yandex_resourcemanager_folder_iam_member" "k8s-clusters-agent" {
    # The service account gets the "k8s.clusters.agent" role.
    folder_id = local.folder_id
    role      = "k8s.clusters.agent"
    member    = "serviceAccount:${yandex_iam_service_account.ha-k8s-account.id}"
  }

  resource "yandex_resourcemanager_folder_iam_member" "vpc-public-admin" {
    # The service account gets the "vpc.publicAdmin" role.
    folder_id = local.folder_id
    role      = "vpc.publicAdmin"
    member    = "serviceAccount:${yandex_iam_service_account.ha-k8s-account.id}"
  }

  resource "yandex_resourcemanager_folder_iam_member" "images-puller" {
    # The service account gets the "container-registry.images.puller" role.
    folder_id = local.folder_id
    role      = "container-registry.images.puller"
    member    = "serviceAccount:${yandex_iam_service_account.ha-k8s-account.id}"
  }

  resource "yandex_resourcemanager_folder_iam_member" "encrypterDecrypter" {
    # The service account gets the "kms.keys.encrypterDecrypter" role.
    folder_id = local.folder_id
    role      = "kms.keys.encrypterDecrypter"
    member    = "serviceAccount:${yandex_iam_service_account.ha-k8s-account.id}"
  }

  resource "yandex_kms_symmetric_key" "kms-key" {
    # Yandex Key Management Service key for encryption of critical information, such as passwords and SSH keys.
    name              = "kms-key"
    default_algorithm = "AES_128"
    rotation_period   = "8760h" # 1 year.
  }

  resource "yandex_vpc_security_group" "ha-k8s-sg" {
    name        = "ha-k8s-sg"
    description = "The group rules ensure the basic performance of the Managed Service for Kubernetes cluster. Apply them to the cluster and node groups."
    network_id  = yandex_vpc_network.my-ha-net.id
    ingress {
      protocol          = "TCP"
      description       = "The rule allows availability checks from the load balancer's range of addresses. It is required for a fault-tolerant Managed Service for Kubernetes cluster and load balancer services."
      predefined_target = "loadbalancer_healthchecks"
      from_port         = 0
      to_port           = 65535
    }
    ingress {
      protocol          = "ANY"
      description       = "The rule allows master-to-node and node-to-node interactions inside a security group."
      predefined_target = "self_security_group"
      from_port         = 0
      to_port           = 65535
    }
    ingress {
      protocol          = "ANY"
      description       = "The rule allows pod-to-pod and service-to-service interactions. Specify the subnets of your Managed Service for Kubernetes cluster and services."
      v4_cidr_blocks    = concat(yandex_vpc_subnet.my-ha-subnet.v4_cidr_blocks, yandex_vpc_subnet.my-ha-subnet.v4_cidr_blocks, yandex_vpc_subnet.my-ha-subnet.v4_cidr_blocks)
      from_port         = 0
      to_port           = 65535
    }
    ingress {
      protocol          = "ICMP"
      description       = "The rule allows debug ICMP packets from internal subnets."
      v4_cidr_blocks    = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
    }
    ingress {
      protocol          = "TCP"
      description       = "The rule allows incoming traffic from the internet to a range of NodePorts. Add ports or replace the existing ones as required."
      v4_cidr_blocks    = ["0.0.0.0/0"]
      from_port         = 30000
      to_port           = 32767
    }
    egress {
      protocol          = "ANY"
      description       = "The rule allows all outgoing traffic. Nodes can connect to Yandex Container Registry, Yandex Object Storage, Docker Hub, etc."
      v4_cidr_blocks    = ["0.0.0.0/0"]
      from_port         = 0
      to_port           = 65535
    }
  }
  ```

{% endlist %}

## Useful links {#see-also}

[Overview of cluster connection methods](../connect/index.md)