[Yandex Cloud documentation](../../../index.md) > [Yandex Managed Service for Kubernetes](../../index.md) > [Step-by-step guides](../index.md) > Managing a node group > Updating a node group

# Updating a Managed Service for Kubernetes node group


Individual nodes in node groups are Yandex Compute Cloud virtual machines with automatically generated names. To configure nodes, follow the steps below or [other node group management guides](../index.md#node-group).

{% note alert %}

Do not change node VM settings, including names, network interfaces, and SSH keys, using the Compute Cloud interfaces or SSH connections to the VM.

This can disrupt the operation of individual nodes, node groups, and the whole Managed Service for Kubernetes cluster.

{% endnote %}

To access a node group, use its name or unique ID obtained using this command:

```bash
yc managed-kubernetes node-group list
```

Result:

```bash
+----------------------+----------------------+-------------+----------------------+---------------------+---------+------+
|          ID          |      CLUSTER ID      |    NAME     |  INSTANCE GROUP ID   |     CREATED AT      | STATUS  | SIZE |
+----------------------+----------------------+-------------+----------------------+---------------------+---------+------+
| catt3knapbq5******** | cati493bu7ia******** | k8s-demo-ng | cl1tbm76ms7p******** | 2019-11-20 12:01:02 | RUNNING |    2 |
+----------------------+----------------------+-------------+----------------------+---------------------+---------+------+
```

Before you start, make sure you have enough [resources](../../concepts/limits.md) in your [cloud](../../../resource-manager/concepts/resources-hierarchy.md#cloud).

## Editing node group settings {#update-settings}

You can update the following parameters of a [Managed Service for Kubernetes node group](../../concepts/index.md#node-group):
* Name.
* Description.
* Scaling for the fixed type: Number of Managed Service for Kubernetes nodes. Scaling for the [automatic type](../../concepts/node-group/cluster-autoscaler.md): Minimum, maximum, and initial number of Managed Service for Kubernetes nodes. You cannot change the scaling type.
* [Kubernetes version](../../concepts/release-channels-and-updates.md).
* Method of assigning [IP addresses](../../../vpc/concepts/address.md) to group nodes: only internal addresses or public addresses as well.

    {% note info %}

    To connect to external resources, e.g., Docker image registries such as [Container Registry](../../../container-registry/concepts/index.md), [Cloud Registry](../../../cloud-registry/concepts/index.md), or [Docker Hub](https://hub.docker.com/) as well as [Object Storage buckets](../../../storage/concepts/bucket.md), the group nodes must have internet access.
    
    To enable internet access, [assign](node-group-update.md#node-internet-access) a public IP address to the nodes and [configure](../connect/security-groups.md#rules-internal-nodegroup) a security group. As an alternative to public IP addresses, you can also create and configure a [NAT gateway](../../../vpc/operations/create-nat-gateway.md) or a [NAT instance](../../../vpc/tutorials/nat-instance/index.md) in the subnet hosting the nodes.

    For more information, see [Internet access for cluster worker nodes](../../concepts/network.md#nodes-internet).

    {% endnote %}

* List of [security groups](../connect/security-groups.md).

  {% note alert %}

  Do not delete [security groups](../../../vpc/concepts/security-groups.md) associated with a running Managed Service for Kubernetes node group as this may disrupt its operation and result in data loss.

  {% endnote %}

* [Computing resources](../../../compute/concepts/vm-platforms.md) and Managed Service for Kubernetes node [disk](../../../compute/concepts/disk.md) size.
* Managed Service for Kubernetes node name template.
* [Updates](../../concepts/release-channels-and-updates.md#updates) policy.

Learn how to change the [availability zone](../../../overview/concepts/geo-scope.md) of a node group in [Migrating Kubernetes resources to a different availability zone](../../tutorials/migration-to-an-availability-zone.md).

{% list tabs group=instructions %}

- Management console {#console}

  To update a Managed Service for Kubernetes node group:
  1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder).
  1. Navigate to **Managed Service for Kubernetes**.
  1. Click the cluster name.
  1. Navigate to the **Node group** tab.
  1. Select the node group you need.
  1. Click **Edit** in the top-right corner.
  1. Change the parameters in the window that opens.
  1. Click **Save**.

- CLI {#cli}

  Get detailed information about the command to update the Managed Service for Kubernetes node group:

  ```bash
  yc managed-kubernetes node-group update --help
  ```

  Use the following flags to update the Managed Service for Kubernetes node group:

  * `--new-name`: Edit the name.
  * `--description`: Edit the description.
  * `--service-account-id`, `--service-account-name`: Change the [service account](../../../iam/concepts/index.md#sa) for resources.
  * `--node-service-account-id`, `--node-service-account-name`: Change the service account for Managed Service for Kubernetes nodes.
  * `--version`: Change the Kubernetes version.
  * `--network-interface`: [Network](../../../vpc/concepts/network.md#network) settings:

    * `security-group-ids`: [Security group](../connect/security-groups.md) IDs.
    * `subnets`: Names of subnets that will host the nodes.
    * `ipv4-address`: IPv4 address assignment method.
    * `ipv6-address`: IPv6 address assignment method.
    
    The `ipv4-address` and `ipv6-address` parameters set the method of assigning IP addresses:
    * `auto`: Assign only internal IP addresses to nodes.
    * `nat`: Assign public and internal IP addresses to nodes.
    
    Public IP addresses are required for [connecting](../connect/index.md) to nodes from the internet and to connect nodes to external resources, such as Docker image registries ([Container Registry](../../../container-registry/concepts/index.md), [Cloud Registry](../../../cloud-registry/concepts/index.md), or [Docker Hub](https://hub.docker.com/)) and [Object Storage](../../../storage/concepts/bucket.md) buckets.
    
    To provide nodes with internet access, assign them a public IP address and [configure](../connect/security-groups.md#rules-internal-nodegroup) a security group. As an alternative to public IP addresses, you can also create and configure a [NAT gateway](../../../vpc/operations/create-nat-gateway.md) or a [NAT instance](../../../vpc/tutorials/nat-instance/index.md) in the subnet hosting the nodes.
    
    If you assign public IP addresses to your cluster nodes and then configure a NAT gateway or NAT instance, you will lose internet access via the public addresses. For more information, see [this Yandex Virtual Private Cloud guide](../../../vpc/concepts/routing.md#internet-routes).

  * `--network-acceleration-type`: Select the [network acceleration](../../../compute/concepts/software-accelerated-network.md) type:
    * `standard`: No acceleration.
    * `software-accelerated`: Software-accelerated network.

      {% note warning %}
      
      Before enabling a [software-accelerated network](../../../compute/concepts/software-accelerated-network.md), make sure you have [enough cloud resources](../../concepts/limits.md) to create an additional [Managed Service for Kubernetes node](../../concepts/index.md#node-group).
      
      {% endnote %}

  * `--node-name`: Change the name template for Managed Service for Kubernetes nodes. The name is unique if the template contains at least one of the following variables:

    * `{instance_group.id}`: Instance group ID.
    * `{instance.index}`: Unique instance number in the group that can be any value from 1 to N, where N is the number of instances in the group.
    * `{instance.index_in_zone}`: Instance number in the zone. It is unique for a specific instance group within a zone.
    * `{instance.short_id}`: Instance ID that is unique within the group. It consists of four alphabetic characters.
    * `{instance.zone_id}`: Zone ID.
    
    For example, `prod-{instance.short_id}-{instance_group.id}`. If you do not specify the name, the default value is used: `{instance_group.id}-{instance.short_id}`.

  * `--template-labels`: Change the [node group cloud labels](../../../resource-manager/concepts/labels.md) in `<label_name>=<label_value>` format. You can specify multiple labels separated by commas.
  * `--latest-revision`: Get all available updates for the current [Managed Service for Kubernetes master](../../concepts/index.md#master) version.
  * Scaling settings:

    * `--fixed-size`: Change the fixed number of nodes in a Managed Service for Kubernetes node group.
    * `--auto-scale`: Change the [autoscaling settings of the Managed Service for Kubernetes cluster](../../concepts/node-group/cluster-autoscaler.md):

      * `min`: Minimum number of nodes in the group.
      * `max`: Maximum number of nodes in the group.
      * `initial`: Initial number of nodes in the group.

    You cannot change the scaling type.

  * `--auto-upgrade`: Manage automatic updates.
  * Managing the maintenance window:
    * `--anytime-maintenance-window`: Update at any time.
    * `--daily-maintenance-window`: Update daily at the selected time.
    * `--weekly-maintenance-window`: Update on selected days.

      {% note info %}
      
      If you activate an update, either daily or on particular days, it may start later than specified.  
      
      {% endnote %}

  {% note warning %}

  * The `user-data` metadata key is not supported for VM tuning or user data transmission.
  * To manage SSH keys, [use the `ssh-keys` key](../../../compute/concepts/vm-metadata.md).
  * To tune your nodes, use privileged DaemonSets, e.g., [sysctl-tuner](https://github.com/elemir/yc-recipes/tree/master/sysctl-tuner).

  {% endnote %}

- Terraform {#tf}

  To update a Managed Service for Kubernetes node group:
  1. Open the current Terraform configuration file describing the Managed Service for Kubernetes node group.

     For more on how to create such a file, see [Creating a node group](node-group-create.md).
  1. Edit the Managed Service for Kubernetes node group description properties.

     * To change the scaling settings, edit the `scale_policy` section as follows:

       * For fixed scaling, change the `fixed_scale.size` parameter.
       * For [autoscaling](../../concepts/node-group/cluster-autoscaler.md), change the `auto_scale` section parameters:

          * `min`: Minimum number of nodes in the group.
          * `max`: Maximum number of nodes in the group.
          * `initial`: Initial number of nodes in the group.

       You cannot change the scaling type.

     * To update the [node group cloud labels](../../../resource-manager/concepts/labels.md), add the `instance_template.labels` section:

       ```hcl
       resource "yandex_kubernetes_node_group" "<node_group_name>" {
         ...
         instance_template {
           ...
           labels {
             "<label_name>"="<label_value>"
           }
         }
       }
       ```

     * To change the Managed Service for Kubernetes node name template, update the `instance_template.name` parameter. The name is unique if the template contains at least one of the following variables:

       * `{instance_group.id}`: Instance group ID.
       * `{instance.index}`: Unique instance number in the group that can be any value from 1 to N, where N is the number of instances in the group.
       * `{instance.index_in_zone}`: Instance number in the zone. It is unique for a specific instance group within a zone.
       * `{instance.short_id}`: Instance ID that is unique within the group. It consists of four alphabetic characters.
       * `{instance.zone_id}`: Zone ID.
       
       For example, `prod-{instance.short_id}-{instance_group.id}`. If you do not specify the name, the default value is used: `{instance_group.id}-{instance.short_id}`.

     * To update [DNS records](../../../dns/concepts/resource-record.md):

       1. Create a [private](../../../dns/operations/zone-create-private.md) or [public](../../../dns/operations/zone-create-public.md) DNS zone.
       1. Add the `instance_template.network_interface.ipv4_dns_records` section:
       
          ```hcl
          resource "yandex_kubernetes_node_group" "<node_group_name>" {
            ...
            instance_template {
              network_interface {
                ipv4_dns_records {
                  fqdn        = "<DNS_record_FQDN>"
                  dns_zone_id = "<DNS_zone_ID>"
                  ttl         = "<DNS_record_TTL_in_seconds>"
                  ptr         = "<create_PTR_record>"
                }
              }
            }
          }
          ```
       
          Where `ptr` indicates if you need to create a PTR record, `true` or `false`.
       
          In a DNS record FQDN, you can use a template with variables:
          * `{instance_group.id}`: Instance group ID.
          * `{instance.index}`: Unique instance number in the group that can be any value from 1 to N, where N is the number of instances in the group.
          * `{instance.index_in_zone}`: Instance number in the zone. It is unique for a specific instance group within a zone.
          * `{instance.short_id}`: Instance ID that is unique within the group. It consists of four alphabetic characters.
          * `{instance.zone_id}`: Zone ID.

  1. Make sure the configuration files are correct.

     1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
     1. Run this command:
     
        ```bash
        terraform validate
        ```
     
        Terraform will show any errors found in your configuration files.

  1. Confirm resource changes.

     1. Run this command to view the planned changes:
     
        ```bash
        terraform plan
        ```
     
        If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
     
     1. If everything looks correct, apply the changes:
        1. Run this command:
     
           ```bash
           terraform apply
           ```
     
        1. Confirm updating the resources.
        1. Wait for the operation to complete.

     {% note warning "Timeouts" %}
     
     The Terraform provider sets time limits for operations with Managed Service for Kubernetes cluster node groups:
     
     * Creating and editing: 60 minutes.
     * Deleting: 20 minutes.
     
     Operations in excess of this time will be interrupted.
     
     {% cut "How do I modify these limits?" %}
     
     Add the `timeouts` section to the cluster node group description, e.g.:
     
     ```hcl
     resource "yandex_kubernetes_node_group" "<node_group_name>" {
       ...
       timeouts {
         create = "1h30m"
         update = "1h30m"
         delete = "60m"
       }
     }
     ```
     
     {% endcut %}
     
     {% endnote %}

     For more information, see [this Terraform provider guide](../../../terraform/resources/kubernetes_node_group.md).

- API {#api}

  To update parameters for a [Managed Service for Kubernetes node group](../../concepts/index.md#node-group), use the [update](../../managed-kubernetes/api-ref/NodeGroup/update.md) REST API method for the [NodeGroup](../../managed-kubernetes/api-ref/NodeGroup/index.md) resource or the [NodeGroupService/Update](../../managed-kubernetes/api-ref/grpc/NodeGroup/update.md) gRPC API call.

  {% note info %}
  
  Below, see parameters for the REST API request body. To specify a parameter in a gRPC API call, convert its name from [lower CamelCase](https://en.wikipedia.org/wiki/Camel_case) to [snake_case](https://en.wikipedia.org/wiki/Snake_case), e.g., `minResourcePresetId` becomes `min_resource_preset_id`.
  
  {% endnote %}

  To update the [node group cloud labels](../../../resource-manager/concepts/labels.md), provide their values in the `nodeTemplate.labels` parameter.

  To update the Managed Service for Kubernetes node name template, provide it in the `nodeTemplate.name` parameter. The name is unique if the template contains at least one of the following variables:

  * `{instance_group.id}`: Instance group ID.
  * `{instance.index}`: Unique instance number in the group that can be any value from 1 to N, where N is the number of instances in the group.
  * `{instance.index_in_zone}`: Instance number in the zone. It is unique for a specific instance group within a zone.
  * `{instance.short_id}`: Instance ID that is unique within the group. It consists of four alphabetic characters.
  * `{instance.zone_id}`: Zone ID.
  
  For example, `prod-{instance.short_id}-{instance_group.id}`. If you do not specify the name, the default value is used: `{instance_group.id}-{instance.short_id}`.

  To update [DNS records](../../../dns/concepts/resource-record.md), provide their settings in the `nodeTemplate.v4AddressSpec.dnsRecordSpecs` parameter. In a DNS record's FQDN, you can use the `nodeTemplate.name` node name template with variables.

{% endlist %}

## Configuring a deployment policy {#configure-deploy-policy}

Using a [deployment policy](../../concepts/node-group/deploy-policy.md), you can control the number of available nodes when modifying or updating a group.

{% list tabs group=instructions %}

- Management console {#console}

  1. Open **Managed Service for&nbsp;Kubernetes** in the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to update the Managed Service for Kubernetes cluster.
  1. Click the name of the Managed Service for Kubernetes cluster.
  1. Navigate to the **Node group** tab.
  1. Select the node group you need.
  1. Click **Edit** in the top-right corner.
  1. Under **Changes during creation and updates**, specify the following settings:

      * **Max group size expansion**: Maximum number of nodes by which you can expand the group when modifying or updating it. The default value is `3`.
      * **Max group size reduction**: Maximum number of nodes that may be unavailable while the group is being modified or updated. The default value is `0`.
      
      For more information, see [Node group deployment policy in Managed Service for Kubernetes](../../concepts/node-group/deploy-policy.md).

  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for updating a Managed Service for Kubernetes node group:

      ```bash
      yc managed-kubernetes node-group update --help
      ```

  1. Run this command:

      ```bash
      yc managed-kubernetes node-group update \
        --name <node_group_name> \
        --max-expansion <node_group_expansion_limit> \
        --max-unavailable <unavailable_nodes_limit>
      ```

      Where:

      * `--max-expansion`: Maximum number of nodes by which you can expand the group when modifying or updating it. The default value is `3`.
      * `--max-unavailable`: Maximum number of nodes that may be unavailable while the group is being modified or updated. The default value is `0`.
      
      For more information, see [Node group deployment policy in Managed Service for Kubernetes](../../concepts/node-group/deploy-policy.md).

      You can get the node group name with the [list of node groups in the folder](node-group-list.md#list).

- Terraform {#tf}

  1. Open the current Terraform configuration file describing the Managed Service for Kubernetes node group.

      For more on how to create such a file, see [Creating a node group](node-group-create.md).

  1. Specify the settings under `deploy_policy`. If there is no such section, add it first.

      ```hcl
      resource "yandex_kubernetes_node_group" "<node_group_name>" {
        cluster_id = yandex_kubernetes_cluster.<cluster_name>.id
        ...
        deploy_policy {
          max_expansion   = <node_group_expansion_limit>
          max_unavailable = <unavailable_nodes_limit>
        }
        ...
      }
      ```

      Where:

      * `max_expansion`: Maximum number of nodes by which you can expand the group when modifying or updating it. The default value is `3`.
      * `max_unavailable`: Maximum number of nodes that may be unavailable while the group is being modified or updated. The default value is `0`.
      
      For more information, see [Node group deployment policy in Managed Service for Kubernetes](../../concepts/node-group/deploy-policy.md).

  1. Make sure the configuration files are correct.

      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.

  1. Confirm resource changes.

      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.

  For more information, see [this Terraform provider guide](../../../terraform/resources/kubernetes_node_group.md).

- API {#api}

  Use the [update](../../managed-kubernetes/api-ref/NodeGroup/update.md) REST API method for the [NodeGroup](../../managed-kubernetes/api-ref/NodeGroup/index.md) resource or the [NodeGroupService/Update](../../managed-kubernetes/api-ref/grpc/NodeGroup/update.md) gRPC API call.

  {% note info %}
  
  Below, see parameters for the REST API request body. To specify a parameter in a gRPC API call, convert its name from [lower CamelCase](https://en.wikipedia.org/wiki/Camel_case) to [snake_case](https://en.wikipedia.org/wiki/Snake_case), e.g., `minResourcePresetId` becomes `min_resource_preset_id`.
  
  {% endnote %}

  Provide the following in the request:
  * Node group ID in the `nodeGroupId` parameter.

    You can get the node group ID with the [list of node groups in the folder](node-group-list.md#list).
  * `updateMask` set to `deployPolicy.maxExpansion,deployPolicy.maxUnavailable`.

    {% note warning %}
    
    The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the `updateMask` parameter as a single comma-separated string.
    
    {% endnote %}

  * `deployPolicy.maxExpansion`: Maximum number of nodes by which you can expand the group when modifying or updating it. The default value is `3`.
  * `deployPolicy.maxUnavailable`: Maximum number of nodes that may be unavailable while the group is being modified or updated. The default value is `0`.
  
  For more information, see [Node group deployment policy in Managed Service for Kubernetes](../../concepts/node-group/deploy-policy.md).

{% endlist %}

## Assigning public IP addresses to nodes {#node-internet-access}

Public IP addresses are required for [connecting](../connect/index.md) to nodes from the internet and to connect nodes to external resources, such as Docker image registries ([Container Registry](../../../container-registry/concepts/index.md), [Cloud Registry](../../../cloud-registry/concepts/index.md), or [Docker Hub](https://hub.docker.com/)) and [Object Storage](../../../storage/concepts/bucket.md) buckets.

To provide nodes with internet access, assign them a public IP address and [configure](../connect/security-groups.md#rules-internal-nodegroup) a security group. As an alternative to public IP addresses, you can also create and configure a [NAT gateway](../../../vpc/operations/create-nat-gateway.md) or a [NAT instance](../../../vpc/tutorials/nat-instance/index.md) in the subnet hosting the nodes.

If you assign public IP addresses to your cluster nodes and then configure a NAT gateway or NAT instance, you will lose internet access via the public addresses. For more information, see [this Yandex Virtual Private Cloud guide](../../../vpc/concepts/routing.md#internet-routes).

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder).
  1. Navigate to **Managed Service for&nbsp;Kubernetes**.
  1. Click the cluster name.
  1. Navigate to the **Node group** tab.
  1. Select the node group you need.
  1. Click **Edit** in the top-right corner.
  1. Under **Network settings**, in the **Public address** field, select the `Auto` IP address assignment method. Nodes will get random public IP addresses from the Yandex Cloud address pool.
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  To assign random public IP addresses from the Yandex Cloud address pool to [Managed Service for Kubernetes nodes](../../concepts/index.md#node-group):

  1. Get detailed information about the command to update the Managed Service for Kubernetes node group:

     ```bash
     yc managed-kubernetes node-group update --help
     ```

  1. Run the node group update command providing the `--network-interface` parameter:

     ```bash
     yc managed-kubernetes node-group update <node_group_ID_or_name> \
     ...
       --network-interface security-group-ids=[<security_group_IDs>],ipv4-address=nat
     ```

     You can get the names and IDs of Managed Service for Kubernetes node groups with the [list of node groups in the folder](node-group-list.md#list).

- Terraform {#tf}

  To assign random public IP addresses from the Yandex Cloud address pool to nodes:

  1. Open the current Terraform configuration file describing the Managed Service for Kubernetes node group.

     For more on how to create such a file, see [Creating a node group](node-group-create.md).

  1. Add `instance_template.network_interface.nat` set to `true` to the node group description:

     ```hcl
     resource "yandex_kubernetes_node_group" "<node_group_name>" {
       ...
       instance_template {
         ...
         network_interface {
           nat = true
         }
       }
     }
     ```

  1. Make sure the configuration files are correct.

     1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
     1. Run this command:
     
        ```bash
        terraform validate
        ```
     
        Terraform will show any errors found in your configuration files.

  1. Confirm resource changes.

     1. Run this command to view the planned changes:
     
        ```bash
        terraform plan
        ```
     
        If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
     
     1. If everything looks correct, apply the changes:
        1. Run this command:
     
           ```bash
           terraform apply
           ```
     
        1. Confirm updating the resources.
        1. Wait for the operation to complete.

     {% note warning "Timeouts" %}
     
     The Terraform provider sets time limits for operations with Managed Service for Kubernetes cluster node groups:
     
     * Creating and editing: 60 minutes.
     * Deleting: 20 minutes.
     
     Operations in excess of this time will be interrupted.
     
     {% cut "How do I modify these limits?" %}
     
     Add the `timeouts` section to the cluster node group description, e.g.:
     
     ```hcl
     resource "yandex_kubernetes_node_group" "<node_group_name>" {
       ...
       timeouts {
         create = "1h30m"
         update = "1h30m"
         delete = "60m"
       }
     }
     ```
     
     {% endcut %}
     
     {% endnote %}

     For more information, see [this Terraform provider guide](../../../terraform/resources/kubernetes_node_group.md).

- API {#api}

  {% note info %}
  
  Below, see parameters for the REST API request body. To specify a parameter in a gRPC API call, convert its name from [lower CamelCase](https://en.wikipedia.org/wiki/Camel_case) to [snake_case](https://en.wikipedia.org/wiki/Snake_case), e.g., `minResourcePresetId` becomes `min_resource_preset_id`.
  
  {% endnote %}

  Use the [update](../../managed-kubernetes/api-ref/NodeGroup/update.md) REST API method for the [NodeGroup](../../managed-kubernetes/api-ref/NodeGroup/index.md) resource or the [NodeGroupService/Update](../../managed-kubernetes/api-ref/grpc/NodeGroup/update.md) gRPC API call, and provide the following in the request:

  * `nodeTemplate.networkInterfaceSpecs.primaryV4AddressSpec.oneToOneNatSpec.ipVersion` in the `updateMask` parameter.

     {% note warning %}
     
     The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the `updateMask` parameter as a single comma-separated string.
     
     {% endnote %}

  * `IPV4` in the `nodeTemplate.networkInterfaceSpecs.primaryV4AddressSpec.oneToOneNatSpec.ipVersion` parameter.

{% endlist %}

## Recreating a node group with a new taint {#assign-taint}

{% note warning %}

Adding [taints](../../concepts/index.md#taints-tolerations) results in removing the current Managed Service for Kubernetes node group and creating a node group with a new configuration.

{% endnote %}

{% list tabs group=instructions %}

- Terraform {#tf}

  To place a taint on a node group:

  1. Open the current Terraform configuration file describing the Managed Service for Kubernetes node group.

     For more on how to create such a file, see [Creating a node group](node-group-create.md).

  1. Add the `node_taints` section to the node group description:

     ```hcl
     resource "yandex_kubernetes_node_group" "<node_group_name>" {
       ...
       node_taints = [
         "<key>=<value>:<taint_effect>",
         ...
       ]
       ...
     }
     ```

     Specify a key and value. Select one of the available taint effects:

     * `NoSchedule`: Prohibit scheduling new pods on the group nodes. It does not affect currently running pods.
     * `PreferNoSchedule`: Avoid scheduling pods on the group nodes if there are resources available for this purpose in other groups.
     * `NoExecute`: Stop pods on the group nodes, evict them to other groups, and prohibit running new pods.

     You can place multiple taints by specifying them separated by commas.

  1. Make sure the configuration files are correct.

     1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
     1. Run this command:
     
        ```bash
        terraform validate
        ```
     
        Terraform will show any errors found in your configuration files.

  1. Confirm resource changes.

     1. Run this command to view the planned changes:
     
        ```bash
        terraform plan
        ```
     
        If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
     
     1. If everything looks correct, apply the changes:
        1. Run this command:
     
           ```bash
           terraform apply
           ```
     
        1. Confirm updating the resources.
        1. Wait for the operation to complete.

     {% note warning "Timeouts" %}
     
     The Terraform provider sets time limits for operations with Managed Service for Kubernetes cluster node groups:
     
     * Creating and editing: 60 minutes.
     * Deleting: 20 minutes.
     
     Operations in excess of this time will be interrupted.
     
     {% cut "How do I modify these limits?" %}
     
     Add the `timeouts` section to the cluster node group description, e.g.:
     
     ```hcl
     resource "yandex_kubernetes_node_group" "<node_group_name>" {
       ...
       timeouts {
         create = "1h30m"
         update = "1h30m"
         delete = "60m"
       }
     }
     ```
     
     {% endcut %}
     
     {% endnote %}

     For more information, see [this Terraform provider guide](../../../terraform/resources/kubernetes_node_group.md).

{% endlist %}

## Recreating a node group without a taint {#remove-taint}

{% note warning %}

Removing [taints](../../concepts/index.md#taints-tolerations) results in removing the current Managed Service for Kubernetes node group and creating a node group with a new configuration.

{% endnote %}

{% list tabs group=instructions %}

- Terraform {#tf}

  To remove a taint from a node group:

  1. Open the current Terraform configuration file describing the Managed Service for Kubernetes node group.

     For more on how to create such a file, see [Creating a node group](node-group-create.md).

  1. In the node group description, remove the taints you no longer need under `node_taints`.

  1. Make sure the configuration files are correct.

     1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
     1. Run this command:
     
        ```bash
        terraform validate
        ```
     
        Terraform will show any errors found in your configuration files.

  1. Confirm resource changes.

     1. Run this command to view the planned changes:
     
        ```bash
        terraform plan
        ```
     
        If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
     
     1. If everything looks correct, apply the changes:
        1. Run this command:
     
           ```bash
           terraform apply
           ```
     
        1. Confirm updating the resources.
        1. Wait for the operation to complete.

     {% note warning "Timeouts" %}
     
     The Terraform provider sets time limits for operations with Managed Service for Kubernetes cluster node groups:
     
     * Creating and editing: 60 minutes.
     * Deleting: 20 minutes.
     
     Operations in excess of this time will be interrupted.
     
     {% cut "How do I modify these limits?" %}
     
     Add the `timeouts` section to the cluster node group description, e.g.:
     
     ```hcl
     resource "yandex_kubernetes_node_group" "<node_group_name>" {
       ...
       timeouts {
         create = "1h30m"
         update = "1h30m"
         delete = "60m"
       }
     }
     ```
     
     {% endcut %}
     
     {% endnote %}

     For more information, see [this Terraform provider guide](../../../terraform/resources/kubernetes_node_group.md).

{% endlist %}

## Managing node group cloud labels {#manage-label}

You can perform the following actions with [cloud labels](../../concepts/index.md#node-labels) of Managed Service for Kubernetes node groups:
* [Add](#add-label)
* [Edit](#update-label)
* [Delete](#remove-label)

### Adding a cloud label {#add-label}

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder).
    1. Navigate to **Managed Service for&nbsp;Kubernetes**.
    1. Click the cluster name.
    1. Navigate to the **Node group** tab.
    1. Select the node group you need.
    1. Click **Edit** in the top-right corner.
    1. In the **Labels** field, click **Add label**.
    1. Enter the key and value, and press **Enter**.
    1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  Add a cloud label to a [Managed Service for Kubernetes node group](../../concepts/index.md#node-group):

  ```bash
  yc managed-kubernetes node-group add-labels my-node-group --labels new_label=test_label
  ```

  Result:

  ```text
  done (28s)
  id: catpl8c44kii********
  cluster_id: catcsqidoos7********
  ...
  ```

- Terraform {#tf}

  1. Open the current Terraform configuration file describing the Managed Service for Kubernetes node group.

     For more on how to create such a file, see [Creating a node group](node-group-create.md).
  1. Add the `labels` property to the Managed Service for Kubernetes node group description:

     ```hcl
     resource "yandex_kubernetes_node_group" "<node_group_name>" {
       cluster_id = yandex_kubernetes_cluster.<cluster_name>.id
       ...
       labels = {
         "<cloud_label>" = "<value>"
       }
       ...
     }
     ```

  1. Make sure the configuration files are correct.

     1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
     1. Run this command:
     
        ```bash
        terraform validate
        ```
     
        Terraform will show any errors found in your configuration files.

  1. Confirm resource changes.

     1. Run this command to view the planned changes:
     
        ```bash
        terraform plan
        ```
     
        If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
     
     1. If everything looks correct, apply the changes:
        1. Run this command:
     
           ```bash
           terraform apply
           ```
     
        1. Confirm updating the resources.
        1. Wait for the operation to complete.

     {% note warning "Timeouts" %}
     
     The Terraform provider sets time limits for operations with Managed Service for Kubernetes cluster node groups:
     
     * Creating and editing: 60 minutes.
     * Deleting: 20 minutes.
     
     Operations in excess of this time will be interrupted.
     
     {% cut "How do I modify these limits?" %}
     
     Add the `timeouts` section to the cluster node group description, e.g.:
     
     ```hcl
     resource "yandex_kubernetes_node_group" "<node_group_name>" {
       ...
       timeouts {
         create = "1h30m"
         update = "1h30m"
         delete = "60m"
       }
     }
     ```
     
     {% endcut %}
     
     {% endnote %}

  For more information, see [this Terraform provider guide](../../../terraform/resources/kubernetes_node_group.md).

{% endlist %}

### Updating a cloud label {#update-label}

{% list tabs group=instructions %}

- Management console {#console}

  To update a cloud label, you will have to remove and recreate it:

    1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder).
    1. Navigate to **Managed Service for&nbsp;Kubernetes**.
    1. Click the cluster name.
    1. Navigate to the **Node group** tab.
    1. Select the node group you need.
    1. Click **Edit** in the top-right corner.
    1. In the **Labels** field, click the cross next to the label to remove it.
    1. Click **Add label** and enter a new key and/or value for the label.
    1. Press **Enter** and click **Save**.

- CLI {#cli}

  Update a cloud label of a Managed Service for Kubernetes node group:

  {% note warning %}
  
  The existing labels (`labels`) will be completely overwritten by the ones you provide in your request.
  
  {% endnote %}

  ```bash
  yc managed-kubernetes node-group update my-node-group --labels test_label=my_ng_label
  ```

  Result:

  ```text
  done (3s)
  id: catpl8c44kii********
  cluster_id: catcsqidoos7********
  ...
  ```

- Terraform {#tf}

  1. Open the current Terraform configuration file describing the Managed Service for Kubernetes node group.

     For more on how to create such a file, see [Creating a node group](node-group-create.md).
  1. Edit the `labels` property in the Managed Service for Kubernetes node group description:

     ```hcl
     resource "yandex_kubernetes_node_group" "<node_group_name>" {
       cluster_id = yandex_kubernetes_cluster.<cluster_name>.id
       ...
       labels = {
         "<cloud_label>" = "<value>"
         ...
       }
       ...
     }
     ```

  1. Make sure the configuration files are correct.

     1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
     1. Run this command:
     
        ```bash
        terraform validate
        ```
     
        Terraform will show any errors found in your configuration files.

  1. Confirm resource changes.

     1. Run this command to view the planned changes:
     
        ```bash
        terraform plan
        ```
     
        If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
     
     1. If everything looks correct, apply the changes:
        1. Run this command:
     
           ```bash
           terraform apply
           ```
     
        1. Confirm updating the resources.
        1. Wait for the operation to complete.

     {% note warning "Timeouts" %}
     
     The Terraform provider sets time limits for operations with Managed Service for Kubernetes cluster node groups:
     
     * Creating and editing: 60 minutes.
     * Deleting: 20 minutes.
     
     Operations in excess of this time will be interrupted.
     
     {% cut "How do I modify these limits?" %}
     
     Add the `timeouts` section to the cluster node group description, e.g.:
     
     ```hcl
     resource "yandex_kubernetes_node_group" "<node_group_name>" {
       ...
       timeouts {
         create = "1h30m"
         update = "1h30m"
         delete = "60m"
       }
     }
     ```
     
     {% endcut %}
     
     {% endnote %}

  For more information, see [this Terraform provider guide](../../../terraform/resources/kubernetes_node_group.md).

{% endlist %}

### Removing a cloud label {#remove-label}

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder).
    1. Navigate to **Managed Service for&nbsp;Kubernetes**.
    1. Click the cluster name.
    1. Navigate to the **Node group** tab.
    1. Select the node group you need.
    1. Click **Edit** in the top-right corner.
    1. In the **Labels** field, click the cross next to the label.
    1. Click **Save**.

- CLI {#cli}

  Remove a cloud label of a Managed Service for Kubernetes node group:

  ```bash
  yc managed-kubernetes node-group remove-labels my-node-group --labels test_label
  ```

  Result:

  ```text
  done (2s)
  id: catpl8c44kii********
  cluster_id: catcsqidoos7********
  ...
  ```

- Terraform {#tf}

  1. Open the current Terraform configuration file describing the Managed Service for Kubernetes node group.

     For more on how to create this file, see [Creating a node group](node-group-create.md).
  1. In the Managed Service for Kubernetes node group description, remove the cloud labels you no longer need under `labels`.
  1. Make sure the configuration files are correct.

     1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
     1. Run this command:
     
        ```bash
        terraform validate
        ```
     
        Terraform will show any errors found in your configuration files.

  1. Confirm resource changes.

     1. Run this command to view the planned changes:
     
        ```bash
        terraform plan
        ```
     
        If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
     
     1. If everything looks correct, apply the changes:
        1. Run this command:
     
           ```bash
           terraform apply
           ```
     
        1. Confirm updating the resources.
        1. Wait for the operation to complete.

     {% note warning "Timeouts" %}
     
     The Terraform provider sets time limits for operations with Managed Service for Kubernetes cluster node groups:
     
     * Creating and editing: 60 minutes.
     * Deleting: 20 minutes.
     
     Operations in excess of this time will be interrupted.
     
     {% cut "How do I modify these limits?" %}
     
     Add the `timeouts` section to the cluster node group description, e.g.:
     
     ```hcl
     resource "yandex_kubernetes_node_group" "<node_group_name>" {
       ...
       timeouts {
         create = "1h30m"
         update = "1h30m"
         delete = "60m"
       }
     }
     ```
     
     {% endcut %}
     
     {% endnote %}

  For more information, see [this Terraform provider guide](../../../terraform/resources/kubernetes_node_group.md).

{% endlist %}

## Changing the method of connecting to nodes in a node group {#switch-node-connect-mode}

{% note info %}

After you change the connection method, the node group status will temporarily change to `Reconciling`: all the group nodes will be recreated for the changes to take effect.

{% endnote %}

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder).
    1. Navigate to **Managed Service for&nbsp;Kubernetes**.
    1. Click the cluster name.
    1. Navigate to the **Node group** tab.
    1. Select the node group you need.
    1. Click **Edit** in the top-right corner.
    1. Change the connection method settings:

        1. To enable or disable access to nodes via OS Login, use the **Access by OS Login** option.

            {% note warning %}
            
            If access via OS Login is enabled, access using SSH keys will not be possible.
            
            {% endnote %}

            For more information on how to configure and use OS Login, see [Connecting to a node via OS Login](../node-connect-oslogin.md).

        1. To enable access to nodes using SSH keys:
           
           1. Make sure access via OS Login is disabled.
           1. Make sure the node group metadata contains at least one SSH key. If needed, add or delete keys by [changing the metadata](node-group-update.md#update-metadata) with the `ssh-keys` key.

            For more information about preparing, configuring, and using SSH keys, see [Connecting to a node over SSH](../node-connect-ssh.md).

        1. To disable access to nodes using SSH keys, do any one of the following:
           
           * Enable access via OS Login.
           * [Change metadata](node-group-update.md#update-metadata) by deleting the metadata with the `ssh-keys` key.
           
              After deleting this metadata, you will not be able to connect to the Managed Service for Kubernetes cluster nodes until you add one or multiple SSH keys.

    1. Click **Save**.

- CLI {#cli}

    1. To enable or disable access to nodes via OS Login, [change the metadata value](node-group-update.md#update-metadata) with the `enable-oslogin` key:
       
       * `true`: Access enabled.
       * `false`: Access disabled.
       
       {% note warning %}
       
       If access via OS Login is enabled, access using SSH keys will not be possible.
       
       {% endnote %}
       
       For more information on how to configure and use OS Login, see [Connecting to a node via OS Login](../node-connect-oslogin.md).

    1. To enable access to nodes using SSH keys:
       
       1. Make sure access via OS Login is disabled.
       1. Make sure the node group metadata contains at least one SSH key. If needed, add or delete keys by [changing the metadata](node-group-update.md#update-metadata) with the `ssh-keys` key.

        For more information about preparing, configuring, and using SSH keys, see [Connecting to a node over SSH](../node-connect-ssh.md).

    1. To disable access to nodes using SSH keys, do any one of the following:
       
       * Enable access via OS Login.
       * [Change metadata](node-group-update.md#update-metadata) by deleting the metadata with the `ssh-keys` key.
       
          After deleting this metadata, you will not be able to connect to the Managed Service for Kubernetes cluster nodes until you add one or multiple SSH keys.

- Terraform {#tf}

    1. To enable or disable access to nodes via OS Login, [change the metadata value](node-group-update.md#update-metadata) with the `enable-oslogin` key:
       
       * `true`: Access enabled.
       * `false`: Access disabled.
       
       {% note warning %}
       
       If access via OS Login is enabled, access using SSH keys will not be possible.
       
       {% endnote %}
       
       For more information on how to configure and use OS Login, see [Connecting to a node via OS Login](../node-connect-oslogin.md).

    1. To enable access to nodes using SSH keys:
       
       1. Make sure access via OS Login is disabled.
       1. Make sure the node group metadata contains at least one SSH key. If needed, add or delete keys by [changing the metadata](node-group-update.md#update-metadata) with the `ssh-keys` key.

        For more information about preparing, configuring, and using SSH keys, see [Connecting to a node over SSH](../node-connect-ssh.md).

    1. To disable access to nodes using SSH keys, do any one of the following:
       
       * Enable access via OS Login.
       * [Change metadata](node-group-update.md#update-metadata) by deleting the metadata with the `ssh-keys` key.
       
          After deleting this metadata, you will not be able to connect to the Managed Service for Kubernetes cluster nodes until you add one or multiple SSH keys.

- API {#api}

    1. To enable or disable access to nodes via OS Login, [change the metadata value](node-group-update.md#update-metadata) with the `enable-oslogin` key:
       
       * `true`: Access enabled.
       * `false`: Access disabled.
       
       {% note warning %}
       
       If access via OS Login is enabled, access using SSH keys will not be possible.
       
       {% endnote %}
       
       For more information on how to configure and use OS Login, see [Connecting to a node via OS Login](../node-connect-oslogin.md).

    1. To enable access to nodes using SSH keys:
       
       1. Make sure access via OS Login is disabled.
       1. Make sure the node group metadata contains at least one SSH key. If needed, add or delete keys by [changing the metadata](node-group-update.md#update-metadata) with the `ssh-keys` key.

        For more information about preparing, configuring, and using SSH keys, see [Connecting to a node over SSH](../node-connect-ssh.md).

    1. To disable access to nodes using SSH keys, do any one of the following:
       
       * Enable access via OS Login.
       * [Change metadata](node-group-update.md#update-metadata) by deleting the metadata with the `ssh-keys` key.
       
          After deleting this metadata, you will not be able to connect to the Managed Service for Kubernetes cluster nodes until you add one or multiple SSH keys.

{% endlist %}

## Updating metadata {#update-metadata}

{% note warning %}

Metadata settings can affect the behavior and health of nodes in a group. Change these settings only if you know exactly what you want to do.

Providing user data in the metadata with the `user-data` key is not supported.

After you update the metadata, the node group status will temporarily change to `Reconciling`: all the group nodes will be recreated for the changes to take effect.

{% endnote %}

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder).
    1. Navigate to **Managed Service for&nbsp;Kubernetes**.
    1. Click the cluster name.
    1. Navigate to the **Node group** tab.
    1. Select the node group you need.
    1. Click **Edit** in the top-right corner.
    1. Expand the **Metadata** section and edit, add, or remove metadata for the nodes.

        To add metadata, click **Add field**. Specify the key and value for each metadata element in a separate set of fields.

    1. Click **Save**.

- CLI {#cli}

    If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

    The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

    1. To add or edit metadata with a specific key:

        1. View the description of the CLI command for adding and updating the Managed Service for Kubernetes node group metadata:

            ```bash
            yc managed-kubernetes node-group add-metadata --help
            ```

        1. To add new metadata or edit existing metadata, run this command:

            ```bash
            yc managed-kubernetes node-group add-metadata \
              --name <node_group_name> \
              --metadata <key>=<value>
            ```

            You can get the node group name with the [list of node groups in the folder](node-group-list.md#list).

            You can get a list of existing metadata with [detailed information about the node group](node-group-list.md#get).

            {% note tip %}

            Use the `--metadata-from-file` parameter instead of `--metadata` to get a value from a file:

            ```bash
            --metadata-from-file <key>=<path_to_file_with_value>
            ```

            The key value will be read from a file. This may be of use if the value is too long to provide it explicitly or if it contains line breaks or other special characters.

            {% endnote %}

    1. To delete metadata with a specific key:

        1. View the description of the CLI command to delete the Managed Service for Kubernetes node group metadata:

            ```bash
            yc managed-kubernetes node-group remove-metadata --help
            ```

        1. Delete existing metadata:

            ```bash
            yc managed-kubernetes node-group remove-metadata \
              --name <node_group_name> \
              --keys <key>
            ```

            You can get the node group name with the [list of node groups in the folder](node-group-list.md#list).

            You can get a list of existing metadata with [detailed information about the node group](node-group-list.md#get).

- Terraform {#tf}

    1. Open the current Terraform configuration file describing the Managed Service for Kubernetes node group.

        For more on how to create this file, see [Creating a node group](node-group-create.md).

    1. To add, edit, or delete metadata with a specific key, edit the list of keys and values in the `instance_template.metadata` parameter. If there is no such parameter, add it.

        ```hcl
        resource "yandex_kubernetes_node_group" "<node_group_name>" {
          cluster_id = yandex_kubernetes_cluster.<cluster_name>.id
          ...
          instance_template {
            metadata = {
              "<key>" = "<value>"
              ...
            }
            ...
          }
          ...
        }
        ```

        {% note tip %}

        Use the `file()` function to get a value from a file:

        ```hcl
        "<key>" = file("<path_to_file_with_value>")
        ```

        The key value will be read from a file. This may be of use if the value is too long to provide it explicitly or if it contains line breaks or other special characters.

        {% endnote %}

    1. Make sure the configuration files are correct.

        1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
        1. Run this command:
        
           ```bash
           terraform validate
           ```
        
           Terraform will show any errors found in your configuration files.

    1. Confirm resource changes.

        1. Run this command to view the planned changes:
        
           ```bash
           terraform plan
           ```
        
           If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
        
        1. If everything looks correct, apply the changes:
           1. Run this command:
        
              ```bash
              terraform apply
              ```
        
           1. Confirm updating the resources.
           1. Wait for the operation to complete.

        {% note warning "Timeouts" %}
        
        The Terraform provider sets time limits for operations with Managed Service for Kubernetes cluster node groups:
        
        * Creating and editing: 60 minutes.
        * Deleting: 20 minutes.
        
        Operations in excess of this time will be interrupted.
        
        {% cut "How do I modify these limits?" %}
        
        Add the `timeouts` section to the cluster node group description, e.g.:
        
        ```hcl
        resource "yandex_kubernetes_node_group" "<node_group_name>" {
          ...
          timeouts {
            create = "1h30m"
            update = "1h30m"
            delete = "60m"
          }
        }
        ```
        
        {% endcut %}
        
        {% endnote %}

    For more information, see [this Terraform provider guide](../../../terraform/resources/kubernetes_node_group.md).

- API {#api}

    {% note info %}
    
    Below, see parameters for the REST API request body. To specify a parameter in a gRPC API call, convert its name from [lower CamelCase](https://en.wikipedia.org/wiki/Camel_case) to [snake_case](https://en.wikipedia.org/wiki/Snake_case), e.g., `minResourcePresetId` becomes `min_resource_preset_id`.
    
    {% endnote %}

    1. Get all existing metadata for a node group using one of the following methods:
       
       * Use the [get](../../managed-kubernetes/api-ref/NodeGroup/get.md) REST API method for the [NodeGroup](../../managed-kubernetes/api-ref/NodeGroup/index.md) resource.
       * Use the [NodeGroupService/Get](../../managed-kubernetes/api-ref/grpc/NodeGroup/get.md) API call.
       
       In your request, provide the node group ID in the `nodeGroupId` parameter. You can get the ID with the [list of node groups in the folder](node-group-list.md#list).
       
       The metadata will be listed as `key=value` pairs in the `nodeTemplate.metadata` field of the response.

    1. Use the [update](../../managed-kubernetes/api-ref/NodeGroup/update.md) REST API method for the [NodeGroup](../../managed-kubernetes/api-ref/NodeGroup/index.md) resource or the [NodeGroupService/Update](../../managed-kubernetes/api-ref/grpc/NodeGroup/update.md) gRPC API call, and provide the following in the request:

        * Node group ID in the `nodeGroupId` parameter.

        * `updateMask` set to `nodeTemplate.metadata`.

            {% note warning %}
            
            The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the `updateMask` parameter as a single comma-separated string.
            
            {% endnote %}

        * The `nodeTemplate.metadata` parameter listing the node group metadata.

            Edit the metadata list you got in the previous step: add, edit, or delete `key=value` pairs. Then provide the updated list in the `nodeTemplate.metadata` parameter.

            {% note alert %}

            Metadata not listed in `nodeTemplate.metadata` will be deleted.

            {% endnote %}

{% endlist %}