Container Firewall Overview

Constraints

• Only the HSS container edition supports this function. For details about how to purchase and upgrade HSS, see Purchasing an HSS Quota and Upgrading Your Edition.
• To operate resource objects in a cluster, you need to obtain either of the following operation permissions:
  • IAM permissions: Tenant Administrator or CCE Administrator.
  • Namespace permissions (authorized by Kubernetes RBAC): O&M permissions. For details about how to configure permissions, see Configuring namespace permissions.

How It Works

A container firewall controls the access scope of source and destination containers based on the access policies for pods and servers, blocking internal and external malicious accesses and attacks.

Protected Cluster Type

Clusters purchased in CCE.

Related Operations

• Creating a Network Policy (for a Cluster Using the Container Tunnel Network Model)
• Creating a Security Group Rule (VPC Network Model Cluster)
• Creating a Security Group Policy (Cloud Native Network 2.0)