A VCI needs to access the API Server of the cluster during startup. If a pod stays in the Pending state without triggering any image pull-related events, the problem may be caused by security group configurations associated with the API Server. This blocks the VCI from connecting to the API Server during initialization.

Solution

You need to modify the security group associated with the API Server of the cluster to allow traffic over the relevant ports between the VCI and the API Server. Follow the steps below to locate and modify the security group associated with the API Server:

In the left navigation bar, click Cluster.

On the cluster list page, click the target cluster.

On the Overview page of the cluster, go to the Overview tab, click the default security group for nodes, then modify the security group to allow traffic on the relevant ports between the VCI and the API Server.

Warning

The default security group for nodes is the security group associated with the API Server of the cluster.

When modifying the default security group for nodes, follow the VKE security group usage rules. For details, see Default security group rules for nodes and Cluster access rules.

Last updated: 2026.03.16 14:55:25

Public security network record in Beijing: No. 11010802032137