Recommended security group settings

KCE uses VPC as the underlying network of containers. This topic describes the rules of using a security group in KCE to help you select proper security group policies.

Security group

A security group is a stateful virtual firewall for KEC instances. A security group is used to control network access for a single or several KEC instances and is an important network isolation mean provided by Kingsoft Cloud. For more information about security groups, see Security groups.

Suggestion on security group selection

1. In a KCE cluster, different Services are distributed on different nodes in the cluster. Pods for different Services may be migrated between nodes based on resource usage. We recommend that you add KEC instances of a cluster to the same security group. Do not add other irrelevant KEC instances to the security group of the cluster.
2. If you expose a Service in NodeIP:NodePort mode, a port is automatically or manually assigned to the Service. The port ranges from 30000 to 32768. In this case, you need to allow access to ports 30000 to 32768 on nodes.
3. Allow access to port 22 if you want to connect to nodes in SSH mode.

Recommended security group settings

Inbound rules

Outbound rules