Container Service for Kubernetes (ACK) clusters use security groups to control network traffic between control plane nodes and worker nodes. Security groups also control traffic between nodes, resources in your Virtual Private Cloud (VPC), and external IP addresses. When you create a cluster or a node pool, a security group is assigned by default. You can also associate an existing security group with the cluster or node pool. If you use an existing security group, no additional access rules are configured by default. You must manage and refine the security group rules yourself.
You can add rules to a security group to allow or deny access for its ECS instances over the public or private network. For more information, see Security group overview and Add a security group rule.
Recommended inbound and outbound security group rules
Basic security groups
Inbound Policies
|
Access control scope |
Protocol |
Port |
Source |
|
Recommended settings |
ICMP |
-1/-1 (all ports) |
0.0.0.0/0 |
|
All protocols |
-1/-1 (all ports) |
|
|
|
Least privilege settings |
All protocols |
53/53 (DNS) |
|
|
ICMP |
-1/-1 (all ports) |
||
|
TCP |
|
||
|
TCP |
9082 |
The port for the Poseidon component. This rule is required only if you use this component. |
|
|
All protocols |
The ports that your applications or components use to receive traffic. |
The source IP addresses or security groups that require access to your applications or components. |
Outbound Policies
|
Access control scope |
Protocol |
Port |
Destination |
|
Recommended settings |
All protocols |
-1/-1 (all ports) |
0.0.0.0/0 |
|
Least privilege settings |
All protocols |
-1/-1 (all ports) |
100.64.0.0/10 (Alibaba Cloud service CIDR block) |
|
All protocols |
53/53 (DNS) |
|
|
|
TCP |
|
||
|
All protocols |
The destination ports that your applications or components need to access. |
The destination IP addresses or security groups that your applications or components need to access. |
Advanced security groups
Inbound Policies
|
Access control scope |
Protocol |
Port |
Source |
|
Recommended settings |
ICMP |
-1/-1 (all ports) |
0.0.0.0/0 |
|
All protocols |
-1/-1 (all ports) |
|
|
|
Least privilege settings |
All protocols |
53/53 (DNS) |
|
|
ICMP |
-1/-1 (all ports) |
||
|
TCP |
|
||
|
TCP |
9082 |
The port for the Poseidon component. This rule is required only if you use this component. |
|
|
All protocols |
The ports on which your applications or components need to receive traffic. |
The source IP addresses or security groups that require access to your applications or components. |
Outbound Policies
|
Access control scope |
Protocol |
Port |
Destination |
|
Recommended settings |
All protocols |
-1/-1 (all ports) |
0.0.0.0/0 |
|
Least privilege settings |
All protocols |
-1/-1 (all ports) |
100.64.0.0/10 (Alibaba Cloud service CIDR block) |
|
All protocols |
53/53 (DNS) |
|
|
|
TCP |
|
||
|
All protocols |
The destination ports that your applications or components need to access. |
The destination IP addresses or security groups that your applications or components need to access. |
Disable security group deletion protection
To prevent accidental deletion, ACK enables deletion protection by default for all security groups associated with clusters. If you attempt to release a security group in the ECS console and encounter an error, it indicates that ACK has enabled deletion protection for that group.
The error message shows that the security group status is Cannot Be Deleted. This status indicates that instances are still associated with the security group. You must remove the instances from the security group before you can delete it.
You cannot manually disable deletion protection for a security group in the console or by calling an API operation. ACK automatically removes the protection only after you delete all clusters that use the security group. To disable the protection, you must identify and delete all clusters that use the security group. Follow these steps to find the associated clusters:
Log on to the ACK console. In the left navigation pane, click Clusters.
-
On the Clusters page, click the name of a cluster. On the Basic Information tab, view the cluster's security group.
After you delete all clusters that use the security group, you can release the security group in the ECS console. If the operation still fails, submit a ticket to the Container Service team.
For more information about how to delete a security group, see Delete a security group.
References
-
For best practices for network security, such as default allow or deny rules and namespace isolation, see Network security.
-
To learn how to plan your Kubernetes cluster network, including CIDR blocks for ECS instances, Kubernetes pods, and Services, see Plan networks for ACK managed clusters.