diff --git a/nodeup/pkg/model/cloudconfig.go b/nodeup/pkg/model/cloudconfig.go
index e12d4f6edfdee..3003d0c53eae4 100644
--- a/nodeup/pkg/model/cloudconfig.go
+++ b/nodeup/pkg/model/cloudconfig.go
@@ -137,6 +137,7 @@ func (b *CloudConfigBuilder) Build(c *fi.ModelBuilderContext) error {
 				fmt.Sprintf("lb-method=%s", fi.StringValue(lb.Method)),
 				fmt.Sprintf("lb-provider=%s", fi.StringValue(lb.Provider)),
 				fmt.Sprintf("use-octavia=%t", fi.BoolValue(lb.UseOctavia)),
+				fmt.Sprintf("manage-security-groups=%t", fi.BoolValue(lb.ManageSecGroups)),
 				"",
 			)
 
diff --git a/pkg/apis/kops/componentconfig.go b/pkg/apis/kops/componentconfig.go
index dabc16ba8b6c1..350579f5b5353 100644
--- a/pkg/apis/kops/componentconfig.go
+++ b/pkg/apis/kops/componentconfig.go
@@ -538,6 +538,7 @@ type OpenstackLoadbalancerConfig struct {
 	FloatingNetworkID *string `json:"floatingNetworkID,omitempty"`
 	FloatingSubnet    *string `json:"floatingSubnet,omitempty"`
 	SubnetID          *string `json:"subnetID,omitempty"`
+	ManageSecGroups   *bool   `json:"manageSecurityGroups,omitempty"`
 }
 
 type OpenstackBlockStorageConfig struct {
diff --git a/pkg/apis/kops/v1alpha1/componentconfig.go b/pkg/apis/kops/v1alpha1/componentconfig.go
index 60a8aaac40994..6f86c9ced8f01 100644
--- a/pkg/apis/kops/v1alpha1/componentconfig.go
+++ b/pkg/apis/kops/v1alpha1/componentconfig.go
@@ -538,6 +538,7 @@ type OpenstackLoadbalancerConfig struct {
 	FloatingNetworkID *string `json:"floatingNetworkID,omitempty"`
 	FloatingSubnet    *string `json:"floatingSubnet,omitempty"`
 	SubnetID          *string `json:"subnetID,omitempty"`
+	ManageSecGroups   *bool   `json:"manageSecurityGroups,omitempty"`
 }
 
 type OpenstackBlockStorageConfig struct {
diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go
index 1410d79c30070..c95bf479beca1 100644
--- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go
+++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go
@@ -4076,6 +4076,7 @@ func autoConvert_v1alpha1_OpenstackLoadbalancerConfig_To_kops_OpenstackLoadbalan
 	out.FloatingNetworkID = in.FloatingNetworkID
 	out.FloatingSubnet = in.FloatingSubnet
 	out.SubnetID = in.SubnetID
+	out.ManageSecGroups = in.ManageSecGroups
 	return nil
 }
 
@@ -4092,6 +4093,7 @@ func autoConvert_kops_OpenstackLoadbalancerConfig_To_v1alpha1_OpenstackLoadbalan
 	out.FloatingNetworkID = in.FloatingNetworkID
 	out.FloatingSubnet = in.FloatingSubnet
 	out.SubnetID = in.SubnetID
+	out.ManageSecGroups = in.ManageSecGroups
 	return nil
 }
 
diff --git a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go
index 143fb892e18fc..f955b0c539d1b 100644
--- a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go
+++ b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go
@@ -2709,6 +2709,11 @@ func (in *OpenstackLoadbalancerConfig) DeepCopyInto(out *OpenstackLoadbalancerCo
 		*out = new(string)
 		**out = **in
 	}
+	if in.ManageSecGroups != nil {
+		in, out := &in.ManageSecGroups, &out.ManageSecGroups
+		*out = new(bool)
+		**out = **in
+	}
 	return
 }
 
diff --git a/pkg/apis/kops/v1alpha2/componentconfig.go b/pkg/apis/kops/v1alpha2/componentconfig.go
index 2e663cf687b7d..2b38cfc738e52 100644
--- a/pkg/apis/kops/v1alpha2/componentconfig.go
+++ b/pkg/apis/kops/v1alpha2/componentconfig.go
@@ -538,6 +538,7 @@ type OpenstackLoadbalancerConfig struct {
 	FloatingNetworkID *string `json:"floatingNetworkID,omitempty"`
 	FloatingSubnet    *string `json:"floatingSubnet,omitempty"`
 	SubnetID          *string `json:"subnetID,omitempty"`
+	ManageSecGroups   *bool   `json:"manageSecurityGroups,omitempty"`
 }
 
 type OpenstackBlockStorageConfig struct {
diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go
index 579f976376348..f73fd006d1708 100644
--- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go
+++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go
@@ -4346,6 +4346,7 @@ func autoConvert_v1alpha2_OpenstackLoadbalancerConfig_To_kops_OpenstackLoadbalan
 	out.FloatingNetworkID = in.FloatingNetworkID
 	out.FloatingSubnet = in.FloatingSubnet
 	out.SubnetID = in.SubnetID
+	out.ManageSecGroups = in.ManageSecGroups
 	return nil
 }
 
@@ -4362,6 +4363,7 @@ func autoConvert_kops_OpenstackLoadbalancerConfig_To_v1alpha2_OpenstackLoadbalan
 	out.FloatingNetworkID = in.FloatingNetworkID
 	out.FloatingSubnet = in.FloatingSubnet
 	out.SubnetID = in.SubnetID
+	out.ManageSecGroups = in.ManageSecGroups
 	return nil
 }
 
diff --git a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go
index 18d580b0f0fc9..4def0f107df6b 100644
--- a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go
+++ b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go
@@ -2780,6 +2780,11 @@ func (in *OpenstackLoadbalancerConfig) DeepCopyInto(out *OpenstackLoadbalancerCo
 		*out = new(string)
 		**out = **in
 	}
+	if in.ManageSecGroups != nil {
+		in, out := &in.ManageSecGroups, &out.ManageSecGroups
+		*out = new(bool)
+		**out = **in
+	}
 	return
 }
 
diff --git a/pkg/apis/kops/zz_generated.deepcopy.go b/pkg/apis/kops/zz_generated.deepcopy.go
index 9010cb3883571..43b0581de4878 100644
--- a/pkg/apis/kops/zz_generated.deepcopy.go
+++ b/pkg/apis/kops/zz_generated.deepcopy.go
@@ -2994,6 +2994,11 @@ func (in *OpenstackLoadbalancerConfig) DeepCopyInto(out *OpenstackLoadbalancerCo
 		*out = new(string)
 		**out = **in
 	}
+	if in.ManageSecGroups != nil {
+		in, out := &in.ManageSecGroups, &out.ManageSecGroups
+		*out = new(bool)
+		**out = **in
+	}
 	return
 }