greennode-vdb · Nov 11, 2026 · Nov 11, 2026
diff --git a/English/overview/product-updates-all/2026.md b/English/overview/product-updates-all/2026.md
@@ -237,6 +237,17 @@ For more details about the updated renewal mechanism and policy, please refer [h
 {% endtab %}
 
 {% tab title="New features" %}
+**Nov 2026**
+
+**VKS — Configure vLB listener ACLs via annotations**
+
+Starting with version **0.4.2** of GreenNode LoadBalancer Controller, you can configure the ACL of a Load Balancer listener directly in your manifest (Service for NLB, Ingress for ALB) — no vLB Portal needed:
+
+* New annotations **`vks.vngcloud.vn/dropped-cidrs`** (comma-separated list of blocked IPv4 CIDRs/IPs, `0.0.0.0/0` = block all) and **`vks.vngcloud.vn/acl-default-action`** (`accept`/`drop` for IPs that match no rule).
+* The existing `vks.vngcloud.vn/inbound-cidrs` annotation now works as a true whitelist: without `acl-default-action`, the default action is **drop**.
+* Removing an annotation restores the listener to its previous ACL value; ACLs configured manually on the Portal are never overwritten.
+* Learn more at [Integrate with Network Load Balancer](../../vks/network/working-with-nlb/integrate-with-network-load-balancer.md) and [Configure for a Network Load Balancer](../../vks/network/working-with-nlb/cau-hinh-cho-mot-network-load-balancer.md).
+
 **Oct 2026**
 
 **GreenNode AI Platform — Guardrail**

diff --git a/English/vks/announcements/release-notes.md b/English/vks/announcements/release-notes.md
@@ -1,5 +1,17 @@
 # Release notes
 
+## Nov 11, 2026
+
+VKS (VNG Kubernetes Engine) has just released a new update with the following improvements:
+
+**New features:**
+
+* **Configure vLB listener ACLs via annotations:** Starting with version **0.4.2** of GreenNode LoadBalancer Controller, you can configure the ACL of a Load Balancer listener directly in your manifest (Service for NLB, Ingress for ALB) — no vLB Portal needed.
+  * New annotations **`vks.vngcloud.vn/dropped-cidrs`** (comma-separated list of blocked IPv4 CIDRs/IPs, `0.0.0.0/0` = block all) and **`vks.vngcloud.vn/acl-default-action`** (`accept`/`drop` for IPs that match no rule).
+  * The existing `vks.vngcloud.vn/inbound-cidrs` annotation now works as a true whitelist: without `acl-default-action`, the default action is **drop**.
+  * Removing an annotation restores the listener to its previous ACL value; ACLs configured manually on the Portal are never overwritten.
+  * See [Integrate with Network Load Balancer](../network/working-with-nlb/integrate-with-network-load-balancer.md) and [Configure for a Network Load Balancer](../network/working-with-nlb/cau-hinh-cho-mot-network-load-balancer.md) for details.
+
 ## Sep 28, 2026 <a href="#sep_07_2026" id="sep_07_2026"></a>
 
 VKS (VNG Kubernetes Engine) has just released a new update with the following improvements:

diff --git a/English/vks/network/working-with-nlb/cau-hinh-cho-mot-network-load-balancer.md b/English/vks/network/working-with-nlb/cau-hinh-cho-mot-network-load-balancer.md
@@ -6,4 +6,6 @@ On the \[Integrate with Network Load Balancer] page, we have shown you how to in
 
 Use the annotations below to customize the Load Balancer to suit your needs:
 
-<table data-header-hidden data-full-width="true"><thead><tr><th width="207"></th><th width="231"></th><th></th></tr></thead><tbody><tr><td><strong>Annotations</strong></td><td><strong>Required/Not required</strong></td><td><strong>Meaning</strong></td></tr><tr><td>vks.vngcloud.vn/load-balancer-id</td><td>Optional</td><td><ul><li><strong>If you do not already have a</strong> previously initialized Network Load Balancer on the vLB system. We will automatically create 1 NLB on your cluster. This NLB will be displayed on vLB Portal, details can be accessed <a href="https://hcm-3.console.greennode.ai/vserver/load-balancer/vlb">here</a></li><li><strong>If you already have a</strong> previously initialized Network Load Balancer on the vLB system and you want to reuse the NLB for your cluster. Now, please enter the Load Balancer ID information into this annotation.</li></ul></td></tr><tr><td>vks.vngcloud.vn/load-balancer-name</td><td>Optional</td><td><ul><li>Annotation <code>vks.vngcloud.vn/load-balancer-name</code>will be used if you <strong>do not</strong> use annotation <code>load-balancer-id</code>.</li><li>Annotation <code>vks.vngcloud.vn/load-balancer-name</code> <strong>only makes sense</strong> when you create a new load balancer. After the load balancer is successfully created, this annotation <strong>will be automatically deleted</strong> . Using this annotation after the load balancer has been created will <strong>have no effect</strong> .</li><li><strong>When you use this annotation, if you do not already have a</strong> previously initialized Network Load Balancer on the vLB system. We will automatically create 1 NLB on your cluster. This ALB will be displayed on vLB Portal, details can be accessed <a href="https://hcm-3.console.greennode.ai/vserver/load-balancer/vlb">here</a></li><li><strong>If you already have a</strong> previously initialized Network Load Balancer on the vLB system and you want to reuse the NLB for your cluster. Now, please enter the Load Balancer Name information into this annotation.</li></ul></td></tr><tr><td>vks.vngcloud.vn/package-id</td><td>Optional</td><td><ul><li>If you do not enter this information, we will use the <strong>NLB Small configuration by default.</strong></li><li>If you already have an ACTIVE vLB host and you want to integrate this host into your K8S cluster, please skip this information field.</li></ul></td></tr><tr><td>vks.vngcloud.vn/tags</td><td>Optional</td><td><ul><li>The tag is added to your NLB.</li></ul></td></tr><tr><td>vks.vngcloud.vn/scheme</td><td>Optional</td><td><ul><li>Default is <strong>internet-facing</strong> , you can change it to <strong>internal</strong> depending on your needs.</li></ul></td></tr><tr><td>vks.vngcloud.vn/security-groups</td><td>Optional</td><td><ul><li>By default, a <strong>default security group</strong> will be created according to your Cluster.</li></ul></td></tr><tr><td>vks.vngcloud.vn/inbound-cidrs</td><td>Optional</td><td><ul><li>Default All CIRD: <strong>0.0.0.0/0</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/healthy-threshold-count</td><td>Optional</td><td><ul><li>Default <strong>3</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/unhealthy-threshold-count</td><td>Optional</td><td><ul><li>Default <strong>3</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-interval-seconds</td><td>Optional</td><td><ul><li>Default <strong>30</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-timeout-seconds</td><td>Optional</td><td><ul><li>Default <strong>5</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-protocol</td><td>Optional</td><td><ul><li>Default <strong>TCP</strong> . Users can select one of the values TCP/ HTTP/ HTTPS/ PING-UDP</li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-http-method</td><td>Optional</td><td><ul><li>Default <strong>GET</strong> . User can choose one of GET / POST / PUT values</li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-path</td><td>Optional</td><td><ul><li>Default <strong>/</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-http-version</td><td>Optional</td><td><ul><li>Default <strong>1.0</strong> . Users can choose one of the values 1.0, 1.1</li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-http-domain-name</td><td>Optional</td><td><ul><li>Default is empty</li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-port</td><td>Optional</td><td><ul><li>Default <strong>traffic port</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/success-codes</td><td>Optional</td><td><ul><li>Default <strong>200</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/idle-timeout-client</td><td>Optional</td><td><ul><li>Default <strong>50</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/idle-timeout-member</td><td>Optional</td><td><ul><li>Default <strong>50</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/idle-timeout-connection</td><td>Optional</td><td><ul><li>Default <strong>5</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/pool-algorithm</td><td>Optional</td><td><ul><li>Default <strong>ROUND_ROBIN</strong> . The user can select one of the values ROUND_ROBIN / LEAST_CONNECTIONS / SOURCE_IP</li></ul></td></tr><tr><td>vks.vngcloud.vn/target-node-labels</td><td>Optional</td><td><ul><li>Default is empty</li></ul></td></tr><tr><td>vks.vngcloud.vn/enable-proxy-protocol</td><td>Optional</td><td><ul><li>Default is empty. The user specifies a list of service names in the Load Balancer to which the Proxy Protocol will be applied.</li></ul></td></tr></tbody></table>
+For listener ACLs, vLB evaluates rules in the following order: **Dropped CIDRs** (block list) → **Allowed CIDRs** (allow list) → **Default action**; the first matching rule wins, and any IP that matches no rule gets the **Default action**. The ACL annotations (`dropped-cidrs`, `inbound-cidrs`, `acl-default-action`) support IPv4 only and require GreenNode LoadBalancer Controller **0.4.2** or later.
+
+<table data-header-hidden data-full-width="true"><thead><tr><th width="207"></th><th width="231"></th><th></th></tr></thead><tbody><tr><td><strong>Annotations</strong></td><td><strong>Required/Not required</strong></td><td><strong>Meaning</strong></td></tr><tr><td>vks.vngcloud.vn/load-balancer-id</td><td>Optional</td><td><ul><li><strong>If you do not already have a</strong> previously initialized Network Load Balancer on the vLB system. We will automatically create 1 NLB on your cluster. This NLB will be displayed on vLB Portal, details can be accessed <a href="https://hcm-3.console.greennode.ai/vserver/load-balancer/vlb">here</a></li><li><strong>If you already have a</strong> previously initialized Network Load Balancer on the vLB system and you want to reuse the NLB for your cluster. Now, please enter the Load Balancer ID information into this annotation.</li></ul></td></tr><tr><td>vks.vngcloud.vn/load-balancer-name</td><td>Optional</td><td><ul><li>Annotation <code>vks.vngcloud.vn/load-balancer-name</code>will be used if you <strong>do not</strong> use annotation <code>load-balancer-id</code>.</li><li>Annotation <code>vks.vngcloud.vn/load-balancer-name</code> <strong>only makes sense</strong> when you create a new load balancer. After the load balancer is successfully created, this annotation <strong>will be automatically deleted</strong> . Using this annotation after the load balancer has been created will <strong>have no effect</strong> .</li><li><strong>When you use this annotation, if you do not already have a</strong> previously initialized Network Load Balancer on the vLB system. We will automatically create 1 NLB on your cluster. This ALB will be displayed on vLB Portal, details can be accessed <a href="https://hcm-3.console.greennode.ai/vserver/load-balancer/vlb">here</a></li><li><strong>If you already have a</strong> previously initialized Network Load Balancer on the vLB system and you want to reuse the NLB for your cluster. Now, please enter the Load Balancer Name information into this annotation.</li></ul></td></tr><tr><td>vks.vngcloud.vn/package-id</td><td>Optional</td><td><ul><li>If you do not enter this information, we will use the <strong>NLB Small configuration by default.</strong></li><li>If you already have an ACTIVE vLB host and you want to integrate this host into your K8S cluster, please skip this information field.</li></ul></td></tr><tr><td>vks.vngcloud.vn/tags</td><td>Optional</td><td><ul><li>The tag is added to your NLB.</li></ul></td></tr><tr><td>vks.vngcloud.vn/scheme</td><td>Optional</td><td><ul><li>Default is <strong>internet-facing</strong> , you can change it to <strong>internal</strong> depending on your needs.</li></ul></td></tr><tr><td>vks.vngcloud.vn/security-groups</td><td>Optional</td><td><ul><li>By default, a <strong>default security group</strong> will be created according to your Cluster.</li></ul></td></tr><tr><td>vks.vngcloud.vn/inbound-cidrs</td><td>Optional</td><td><ul><li>Default All CIDR: <strong>0.0.0.0/0</strong></li><li>Comma-separated list of <strong>IPv4</strong> CIDRs/IPs allowed to access the listener (Allowed CIDRs), evaluated after <code>dropped-cidrs</code>.</li><li>If you set this annotation without setting <code>vks.vngcloud.vn/acl-default-action</code>, the default action is <strong>drop</strong> — only the declared IP ranges can access the listener.</li><li>Removing this annotation restores the listener to its previous ACL value (usually <strong>0.0.0.0/0</strong>).</li></ul></td></tr><tr><td>vks.vngcloud.vn/dropped-cidrs</td><td>Optional</td><td><ul><li>Comma-separated list of blocked <strong>IPv4</strong> CIDRs/IPs (Dropped CIDRs). Example: <code>203.0.113.9/32,198.51.100.0/24</code>.</li><li><strong>0.0.0.0/0</strong>: block all access to the listener.</li><li>Empty string <code>""</code>: clear the block list (the controller still manages the list).</li><li>Evaluated before <code>inbound-cidrs</code>: an IP present in both lists is blocked.</li><li>Blocked traffic is silently discarded, so the client sees a timeout.</li></ul></td></tr><tr><td>vks.vngcloud.vn/acl-default-action</td><td>Optional</td><td><ul><li>Action applied to IPs that match no ACL rule: <strong>accept</strong> or <strong>drop</strong> (case-insensitive).</li><li>If you set <code>inbound-cidrs</code> without this annotation, the controller sets the default action to <strong>drop</strong>.</li></ul></td></tr><tr><td>vks.vngcloud.vn/healthy-threshold-count</td><td>Optional</td><td><ul><li>Default <strong>3</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/unhealthy-threshold-count</td><td>Optional</td><td><ul><li>Default <strong>3</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-interval-seconds</td><td>Optional</td><td><ul><li>Default <strong>30</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-timeout-seconds</td><td>Optional</td><td><ul><li>Default <strong>5</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-protocol</td><td>Optional</td><td><ul><li>Default <strong>TCP</strong> . Users can select one of the values TCP/ HTTP/ HTTPS/ PING-UDP</li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-http-method</td><td>Optional</td><td><ul><li>Default <strong>GET</strong> . User can choose one of GET / POST / PUT values</li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-path</td><td>Optional</td><td><ul><li>Default <strong>/</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-http-version</td><td>Optional</td><td><ul><li>Default <strong>1.0</strong> . Users can choose one of the values 1.0, 1.1</li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-http-domain-name</td><td>Optional</td><td><ul><li>Default is empty</li></ul></td></tr><tr><td>vks.vngcloud.vn/healthcheck-port</td><td>Optional</td><td><ul><li>Default <strong>traffic port</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/success-codes</td><td>Optional</td><td><ul><li>Default <strong>200</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/idle-timeout-client</td><td>Optional</td><td><ul><li>Default <strong>50</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/idle-timeout-member</td><td>Optional</td><td><ul><li>Default <strong>50</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/idle-timeout-connection</td><td>Optional</td><td><ul><li>Default <strong>5</strong></li></ul></td></tr><tr><td>vks.vngcloud.vn/pool-algorithm</td><td>Optional</td><td><ul><li>Default <strong>ROUND_ROBIN</strong> . The user can select one of the values ROUND_ROBIN / LEAST_CONNECTIONS / SOURCE_IP</li></ul></td></tr><tr><td>vks.vngcloud.vn/target-node-labels</td><td>Optional</td><td><ul><li>Default is empty</li></ul></td></tr><tr><td>vks.vngcloud.vn/enable-proxy-protocol</td><td>Optional</td><td><ul><li>Default is empty. The user specifies a list of service names in the Load Balancer to which the Proxy Protocol will be applied.</li></ul></td></tr></tbody></table>
diff --git a/English/vks/network/working-with-nlb/integrate-with-network-load-balancer.md b/English/vks/network/working-with-nlb/integrate-with-network-load-balancer.md
@@ -315,6 +315,60 @@ kubectl apply -f nginx-service-lb4.yaml
 
 ***
 
+### Block access with ACL annotations <a href="#integratewithnetworkloadbalancer-blockaccesswithaclannotations" id="integratewithnetworkloadbalancer-blockaccesswithaclannotations"></a>
+
+Starting with version **0.4.2** of GreenNode LoadBalancer Controller, you can configure the ACL of a Load Balancer listener directly in your manifest (Service or Ingress) without using the vLB Portal. ACL rules are evaluated in the following order: **Dropped CIDRs** → **Allowed CIDRs** → **Default action**; the first matching rule wins, and any IP that matches no rule gets the **Default action**. Dropped traffic is silently discarded, so the client sees a timeout instead of a connection refusal.
+
+Related annotations:
+
+* `vks.vngcloud.vn/dropped-cidrs`: comma-separated list of blocked IPv4 CIDRs/IPs.
+* `vks.vngcloud.vn/inbound-cidrs`: comma-separated list of allowed IPv4 CIDRs/IPs.
+* `vks.vngcloud.vn/acl-default-action`: `accept` or `drop`.
+
+For example, block two sources from accessing the nginx Service above by adding this annotation to the Service:
+
+```
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx-service
+  annotations:
+    vks.vngcloud.vn/dropped-cidrs: "203.0.113.9/32,198.51.100.0/24"
+spec:
+  selector:
+    app: nginx
+  type: LoadBalancer
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80
+```
+
+Then run `kubectl apply -f nginx-service-lb4.yaml` again to update the Service.
+
+Common use cases:
+
+| Goal | Annotation |
+|---|---|
+| Block specific IPs/ranges | `vks.vngcloud.vn/dropped-cidrs: "203.0.113.9/32,198.51.100.0/24"` |
+| Allow only specific IP ranges | `vks.vngcloud.vn/inbound-cidrs: "192.0.2.0/24"` |
+| Allow a range except a few IPs | `vks.vngcloud.vn/inbound-cidrs: "192.0.2.0/24"` and `vks.vngcloud.vn/dropped-cidrs: "192.0.2.13/32"` |
+| Block all access | `vks.vngcloud.vn/dropped-cidrs: "0.0.0.0/0"` |
+
+{% hint style="info" %}
+Notes:
+
+* ACL annotations support IPv4 only and require GreenNode LoadBalancer Controller **0.4.2** or later. They also work for Ingress (ALB).
+* If you set `inbound-cidrs` without `acl-default-action`, the default action is `drop` — only the declared IP ranges can access the listener.
+* Invalid values (malformed CIDR, IPv6, unknown default action) make the Service/Ingress report an error, and the ACL keeps the last valid configuration.
+* Removing the annotation restores the listener ACL to the value it had before the controller took over.
+* If multiple Services/Ingresses share one Load Balancer, declare the ACL consistently; otherwise the controller reports a conflict.
+{% endhint %}
+
+For the full meaning of each annotation, see [Configure for a Network Load Balancer](cau-hinh-cho-mot-network-load-balancer.md).
+
+***
+
 ### **Step 2: Check Deployment and Service information just deployed** <a href="#kiem-tra-thong-tin-deployment-service-vua-deploy" id="kiem-tra-thong-tin-deployment-service-vua-deploy"></a>
 
 * Run the following command to test **Deployment**

diff --git a/Vietnamese/gioi-thieu-chung/thong-bao-va-cap-nhat/2026.md b/Vietnamese/gioi-thieu-chung/thong-bao-va-cap-nhat/2026.md
@@ -232,6 +232,17 @@ Chính sách gia hạn tài nguyên này áp dụng từ ngày 8/1/2026 và áp
 {% endtab %}
 
 {% tab title="Tính năng mới" %}
+**Tháng 11, 2026**
+
+**VKS – Cấu hình ACL listener vLB qua annotation**
+
+GreenNode LoadBalancer Controller (từ phiên bản **0.4.2**) cho phép cấu hình ACL cho listener của Load Balancer ngay trên manifest (Service NLB, Ingress ALB), không cần vào vLB Portal:
+
+* Thêm annotation **`vks.vngcloud.vn/dropped-cidrs`** (danh sách CIDR/IP IPv4 bị chặn, `0.0.0.0/0` = chặn toàn bộ) và **`vks.vngcloud.vn/acl-default-action`** (`accept`/`drop` cho IP không khớp rule nào).
+* Annotation `vks.vngcloud.vn/inbound-cidrs` có sẵn nay mang đúng nghĩa whitelist: không đặt `acl-default-action` thì default action là **drop**.
+* Gỡ annotation trả listener về giá trị ACL trước đó; ACL đặt tay trên Portal không bị ghi đè.
+* Tìm hiểu thêm tại [Integrate with Network Load Balancer](../../vks/network/working-with-nlb/integrate-with-network-load-balancer.md) và [Cấu hình cho một Network Load Balancer](../../vks/network/working-with-nlb/cau-hinh-cho-mot-network-load-balancer.md).
+
 **Tháng 10, 2026**
 
 **GreenNode AI Platform — Guardrail**