All Products
Search
Document Center

Container Service for Kubernetes:Configure and manage cluster security groups

Last Updated:Jun 20, 2026

Container Service for Kubernetes (ACK) clusters use security groups to control network traffic between control plane nodes and worker nodes. Security groups also control traffic between nodes, resources in your Virtual Private Cloud (VPC), and external IP addresses. When you create a cluster or a node pool, a security group is assigned by default. You can also associate an existing security group with the cluster or node pool. If you use an existing security group, no additional access rules are configured by default. You must manage and refine the security group rules yourself.

You can add rules to a security group to allow or deny access for its ECS instances over the public or private network. For more information, see Security group overview and Add a security group rule.

Recommended inbound and outbound security group rules

Basic security groups

Inbound Policies

Access control scope

Protocol

Port

Source

Recommended settings

ICMP

-1/-1 (all ports)

0.0.0.0/0

All protocols

-1/-1 (all ports)

  • The ID of the cluster's default security group.

  • The pod CIDR block of the cluster. This rule is required for Flannel network mode but not for Terway network mode.

Least privilege settings

All protocols

53/53 (DNS)

  • The ID of the cluster's default security group.

  • The pod CIDR block of the cluster. This rule is required for Flannel network mode but not for Terway network mode.

ICMP

-1/-1 (all ports)

TCP

  • 10250 (kubelet)

  • 10255 (kubelet)

  • 443 (webhook)

  • 6443 (API server)

  • 8082 (heapster)

  • The listening port for an in-cluster application or component that provides webhook services, such as port 8443 used by the Gatekeeper component.

TCP

9082

The port for the Poseidon component. This rule is required only if you use this component.

All protocols

The ports that your applications or components use to receive traffic.

The source IP addresses or security groups that require access to your applications or components.

Outbound Policies

Access control scope

Protocol

Port

Destination

Recommended settings

All protocols

-1/-1 (all ports)

0.0.0.0/0

Least privilege settings

All protocols

-1/-1 (all ports)

100.64.0.0/10 (Alibaba Cloud service CIDR block)

All protocols

53/53 (DNS)

  • The IP address of the API server's SLB instance.

  • The ID of the cluster's default security group.

  • The pod CIDR block of the cluster. This rule is required for Flannel network mode but not for Terway network mode.

TCP

  • 10250 (kubelet)

  • 10255 (kubelet)

  • 443 (API server)

  • 6443 (API server)

All protocols

The destination ports that your applications or components need to access.

The destination IP addresses or security groups that your applications or components need to access.

Advanced security groups

Inbound Policies

Access control scope

Protocol

Port

Source

Recommended settings

ICMP

-1/-1 (all ports)

0.0.0.0/0

All protocols

-1/-1 (all ports)

  • The CIDR block of the VPC where the cluster is deployed.

  • The secondary CIDR blocks of the cluster's VPC.

  • The pod CIDR block of the cluster. This rule is required for Flannel network mode but not for Terway network mode.

Least privilege settings

All protocols

53/53 (DNS)

  • The CIDR blocks of all vSwitches associated with the cluster, including those for nodes and pods.

  • The pod CIDR block of the cluster. This rule is required for Flannel network mode but not for Terway network mode.

ICMP

-1/-1 (all ports)

TCP

  • 10250 (kubelet)

  • 10255 (kubelet)

  • 443 (webhook)

  • 6443 (API server)

  • 8082 (heapster)

  • The listening port for an in-cluster application or component that provides webhook services, such as port 8443 used by the Gatekeeper component.

TCP

9082

The port for the Poseidon component. This rule is required only if you use this component.

All protocols

The ports on which your applications or components need to receive traffic.

The source IP addresses or security groups that require access to your applications or components.

Outbound Policies

Access control scope

Protocol

Port

Destination

Recommended settings

All protocols

-1/-1 (all ports)

0.0.0.0/0

Least privilege settings

All protocols

-1/-1 (all ports)

100.64.0.0/10 (Alibaba Cloud service CIDR block)

All protocols

53/53 (DNS)

  • The IP address of the API server's SLB instance.

  • The CIDR blocks of all vSwitches associated with the cluster, including those for nodes and pods.

  • The pod CIDR block of the cluster. This rule is required for Flannel network mode but not for Terway network mode.

TCP

  • 10250 (kubelet)

  • 10255 (kubelet)

  • 443 (API server)

  • 6443 (API server)

All protocols

The destination ports that your applications or components need to access.

The destination IP addresses or security groups that your applications or components need to access.

Disable security group deletion protection

To prevent accidental deletion, ACK enables deletion protection by default for all security groups associated with clusters. If you attempt to release a security group in the ECS console and encounter an error, it indicates that ACK has enabled deletion protection for that group.

The error message shows that the security group status is Cannot Be Deleted. This status indicates that instances are still associated with the security group. You must remove the instances from the security group before you can delete it.

You cannot manually disable deletion protection for a security group in the console or by calling an API operation. ACK automatically removes the protection only after you delete all clusters that use the security group. To disable the protection, you must identify and delete all clusters that use the security group. Follow these steps to find the associated clusters:

  1. Log on to the ACK console. In the left navigation pane, click Clusters.

  2. On the Clusters page, click the name of a cluster. On the Basic Information tab, view the cluster's security group.

    After you delete all clusters that use the security group, you can release the security group in the ECS console. If the operation still fails, submit a ticket to the Container Service team.

For more information about how to delete a security group, see Delete a security group.

References

  • For best practices for network security, such as default allow or deny rules and namespace isolation, see Network security.

  • To learn how to plan your Kubernetes cluster network, including CIDR blocks for ECS instances, Kubernetes pods, and Services, see Plan networks for ACK managed clusters.