[Yandex Cloud documentation](../index.md) > [Yandex Managed Service for Kubernetes](index.md) > Getting started

# Getting started with Managed Service for Kubernetes


Create a [Managed Service for Kubernetes cluster](concepts/index.md#kubernetes-cluster) and [node group](concepts/index.md#node-group) and manage them using kubectl, the Kubernetes command line interface.

## Getting started {#before-you-begin}

To get started with Managed Service for Kubernetes:
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or sign up if not signed up yet.
1. On the [**Yandex Cloud Billing**](https://center.yandex.cloud/billing/accounts) page, make sure you have a [billing account](../billing/concepts/billing-account.md) linked and its status is `ACTIVE` or `TRIAL_ACTIVE`. If you do not have a billing account yet, [create one](../billing/quickstart/index.md#create_billing_account).
1. If you do not have a [folder](../resource-manager/concepts/resources-hierarchy.md#folder) yet, [create one](../resource-manager/operations/folder/create.md).
1. Install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/), the Kubernetes CLI.
1. Make sure you have enough [resources available in the cloud](concepts/limits.md).
1. If you do not have a [network](../vpc/concepts/network.md#network) yet, [create one](../vpc/operations/network-create.md).
1. If you do not have any [subnets](../vpc/concepts/network.md#subnet) yet, [create them](../vpc/operations/subnet-create.md) in the [availability zones](../overview/concepts/geo-scope.md) where the new Managed Service for Kubernetes cluster and node group will reside.
1. Create these [service accounts](../iam/operations/sa/create.md):

   * Service account with the `k8s.clusters.agent` and `vpc.publicAdmin` [roles](security/index.md#yc-api) for the folder where you want to create a Managed Service for Kubernetes cluster. This service account will be used to create the resources for the Managed Service for Kubernetes cluster.
   * Service account with the [container-registry.images.puller](../container-registry/security/index.md#container-registry-images-puller) role for the folder containing the [Docker image](../container-registry/concepts/docker-image.md) registry in [Yandex Container Registry](../container-registry/concepts/index.md). The Managed Service for Kubernetes nodes will use this account to pull the required Docker images from the registry.

     If you want to use the [Docker image](../cloud-registry/concepts/artifacts/docker.md) registry in [Yandex Cloud Registry](../cloud-registry/concepts/index.md), assign the [cloud-registry.artifacts.puller](../cloud-registry/security/index.md#cloud-registry-artifacts-puller) role to the service account.

   You can use the same service account for both operations.

   {% note info %}
   
   To create a cluster with [tunnel mode](concepts/network-policy.md#cilium), its service account requires the `k8s.tunnelClusters.agent` role.
   
   {% endnote %}
1. [Configure security groups](operations/connect/security-groups.md#rules-internal) for network traffic of your Managed Service for Kubernetes cluster.

## Create a Managed Service for Kubernetes cluster {#kubernetes-cluster-create}

1. In the [management console](https://console.yandex.cloud), select the folder where you want to create a Managed Service for Kubernetes cluster.
1. Navigate to **Managed Service for Kubernetes**.
1. Click **Create cluster**.
1. Enter the Managed Service for Kubernetes cluster name. It must be unique within the folder.
1. Optionally, enter a description for the Managed Service for Kubernetes cluster.
1. **Service account for resources**: Specify the [service account](../iam/concepts/users/service-accounts.md) with the `k8s.clusters.agent` and `vpc.publicAdmin` roles to use for creating resources.
1. **Service account for nodes**: Specify the service account with the [container-registry.images.puller](../container-registry/security/index.md#container-registry-images-puller) role the Managed Service for Kubernetes nodes will use to access the [Docker image](../container-registry/concepts/docker-image.md) registry in Yandex Container Registry.
1. Specify the [release channel](concepts/release-channels-and-updates.md). You will not be able to edit this setting once you create the Managed Service for Kubernetes cluster.
1. Under **Master configuration**:
   * **Kubernetes version**: Select the Kubernetes version to install on the [Managed Service for Kubernetes master](concepts/index.md#master).
   * **Public address**: Select the [IP address](../vpc/concepts/address.md) assignment method:
     * `Auto`: Assign a random IP address from the Yandex Cloud IP address pool.
     * `No address`: Do not assign a public IP address.
   * **Type of master**: Select the master type:
     * `Basic`: To create a single master host in the selected availability zone. Specify the cloud network and select the subnet for the master host.
     * `Highly available`: To create a single master host in each availability zone. Specify the cloud network and subnet for each availability zone.

     {% note warning %}
     
     Do not change or delete Virtual Private Cloud resources used by the Managed Service for Kubernetes cluster. This may cause cluster errors or make it impossible to delete later.
     
     {% endnote %}

     {% note warning %}
     
     Starting June 18, 2026, master node pricing has changed, with fees now based on the number of vCPUs and the amount of RAM. Use [this table](concepts/master-configuration.md) to estimate the required master node resources for your cluster.
     
     {% endnote %}

   * Select [security groups](operations/connect/security-groups.md) for the Managed Service for Kubernetes cluster's network traffic.
1. Under **Cluster network settings**:
   * **CIDR cluster**: Specify the IP address range to allocate addresses to [pods](concepts/index.md#pod) from.
   * **CIDR services**: Specify the IP address range to allocate IP addresses to [services](concepts/index.md#service) from.
   * Set the subnet mask for the Managed Service for Kubernetes nodes and the maximum number of pods per node.
1. Click **Create**.

For more information, see [this step-by-step guide for creating a Managed Service for Kubernetes cluster](operations/kubernetes-cluster/kubernetes-cluster-create.md).

## Create a node group {#node-group-create}

To create a Managed Service for Kubernetes node group:
1. In the [management console](https://console.yandex.cloud), select the folder where you created the required Managed Service for Kubernetes cluster.
1. Navigate to **Managed Service for Kubernetes**.
1. Select the Managed Service for Kubernetes cluster to create a node group for.
1. On the Managed Service for Kubernetes cluster page, go to the ![nodes-management.svg](../_assets/console-icons/graph-node.svg) **Node management** tab.
1. Click **Create a node group**.
1. Enter a name and description for the Managed Service for Kubernetes node group.
1. In the **Kubernetes version** field, select the Kubernetes version for the Managed Service for Kubernetes nodes.
1. Under **Scaling**, select its type:
   * `Fixed`, to keep a fixed number of nodes in the Managed Service for Kubernetes group. Specify this number.
   * `Automatic`, to manage the number of nodes in the Managed Service for Kubernetes group using [Managed Service for Kubernetes cluster autoscaling](concepts/autoscale.md#ca).
1. Under **Changes during creation and updates**, specify the maximum number of [VMs](../compute/concepts/vm.md) by which you can exceed or reduce the Managed Service for Kubernetes group size.
1. Under **Computing resources**:
   * Select a [platform](../compute/concepts/vm-platforms.md).
   * Specify the required number of vCPUs, [guaranteed vCPU performance](../compute/concepts/performance-levels.md), and the amount of RAM.
   * Optionally, make the VM instance [preemptible](../compute/concepts/preemptible-vm.md) by checking the relevant box.
   * Optionally, enable a [software accelerated network](../compute/concepts/software-accelerated-network.md).

1. Under **Storage**:
   * Specify the **Disk type** for the Managed Service for Kubernetes group nodes:
     * `HDD`: Standard network drive; HDD network block storage.
     * `SSD`: Fast network drive; SSD network block storage.
     * `Non-replicated SSD`: Network drive with enhanced performance achieved by eliminating redundancy. You can only change the size of this disk type in 93 GB increments.
     * `SSD IO`: Network drive with the same performance specifications as `Non-replicated SSD`, plus redundancy. You can only change the size of this disk type in 93 GB increments.

     For more information about disk types, see [this Yandex Compute Cloud tutorial](../compute/concepts/disk.md#disks_types).
   * Specify the disk size for the Managed Service for Kubernetes group nodes.
1. Under **Network settings**:
   * In the **Public address** field, select an IP address assignment method:
     * `Auto`: Assign a random IP address from the Yandex Cloud IP address pool.
     * `No address`: Do not assign a public IP address.

     {% note info %}
     
     To connect to external resources, e.g., Docker image registries such as [Container Registry](../container-registry/concepts/index.md), [Cloud Registry](../cloud-registry/concepts/index.md), or [Docker Hub](https://hub.docker.com/) as well as [Object Storage buckets](../storage/concepts/bucket.md), the group nodes must have internet access.
     
     To enable internet access, [assign](operations/node-group/node-group-update.md#node-internet-access) a public IP address to the nodes and [configure](operations/connect/security-groups.md#rules-internal-nodegroup) a security group. As an alternative to public IP addresses, you can also create and configure a [NAT gateway](../vpc/operations/create-nat-gateway.md) or a [NAT instance](../vpc/tutorials/nat-instance/index.md) in the subnet hosting the nodes.
     
     For more information, see [Internet access for cluster worker nodes](concepts/network.md#nodes-internet).
     
     {% endnote %}

   * Select [security groups](operations/connect/security-groups.md).
   * Select the availability zone and subnet to place the Managed Service for Kubernetes group nodes in.

     {% note warning %}
     
     Do not change or delete Virtual Private Cloud resources used by the Managed Service for Kubernetes cluster. This may cause cluster errors or make it impossible to delete later.
     
     {% endnote %}

1. Under **Access**, specify the access credentials for the Managed Service for Kubernetes group nodes over SSH:
   * **Login**: Enter the username.
   * **SSH key**: Paste the contents of the [public key](operations/node-connect-ssh.md#creating-ssh-keys) file.
1. Click **Create**.

For more information, see [this step-by-step guide on creating a Managed Service for Kubernetes node group](operations/node-group/node-group-create.md).

## Add credentials to the kubectl configuration file {#add-conf}

With `kubectl`, you can manage a Managed Service for Kubernetes cluster. To configure the utility to work with the created cluster, add its credentials to the kubectl configuration file:

{% list tabs group=instructions %}

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. Run this command:

     ```bash
     yc managed-kubernetes cluster get-credentials test-k8s-cluster --external
     ```

     {% note tip %}

     You can also view the connection command in the [management console](https://console.yandex.cloud) on the cluster page under **Access**.

     {% endnote %}

     * By default, credentials are added to the `$HOME/.kube/config` directory.
     * If you need to change the configuration location, use the `--kubeconfig <file_path>` parameter.
     
  1. Check the `kubectl` configuration after adding the credentials:

     ```bash
     kubectl config view
     ```

     Result:

     ```yml
     apiVersion: v1
     clusters:
       - cluster:
         certificate-authority-data: DATA+OMITTED
     ...
     ```
  1. Check the connection to the cluster:
  
     ```bash
     kubectl get nodes
     ```

     The command will return information about the node group you created:
   
     ```bash
     NAME                       STATUS  ROLES   AGE  VERSION
     cl17i6943n92********-itif  Ready   <none>  31m  v1.13.3
     ```
  
     To learn more about connecting to a Managed Service for Kubernetes cluster, see [Overview of connection methods](operations/connect/index.md).

{% endlist %}

## What's next {#what-is-next}

* Read about [service concepts](concepts/index.md).
* Learn how to [work with a Managed Service for Kubernetes cluster and node groups](operations/index.md).
* Check [questions and answers](qa/all.md).
* Check the [recommendations on using Kubernetes](concepts/usage-recommendations.md).