Help Center/ Host Security Service/ User Guide/ Container Protection/ Container Firewalls/ Configuring a Network Defense Policy (for a Container Tunnel Network)
Updated on 2025-09-17 GMT+08:00
View PDF
Share

Configuring a Network Defense Policy (for a Container Tunnel Network)

Scenarios

If no network defense policies are configured for a pod, all traffic is allowed to enter and leave the pod by default. In this case, pods can communicate with each other and access the external network, which poses security risks.

To improve the security of a cluster using the container tunnel network model, you can configure a network defense policy for the cluster to restrict the communication between pods and the access from pods to the external network.

Constraints

  • Currently, the container firewall only supports network policies for pods running on nodes with the following OSs: EulerOS, CentOS, Huawei Cloud EulerOS 2.0
  • The CCE standard clusters of v1.23 and later support inbound and outbound rules. CCE standard clusters earlier than v1.23 only support inbound rules.
  • Network isolation is not supported for IPv6 addresses.
  • ClusterIP access cannot be restricted by workload labels.

Creating a Network Defense Policy

You can create a network defense policy in various ways.

  1. Log in to the HSS console.
  2. Click in the upper left corner and select a region or project.
  3. In the navigation pane on the left, choose Container Protection > Container Firewalls.
  4. (Optional) If you have enabled the enterprise project, select the enterprise project where the target server resides from the drop-down list.
  5. Click Synchronize above the cluster list to synchronize the policies created on clusters.

    The synchronization takes about 1 to 2 minutes. Wait for a while and click in the upper right corner of the list to refresh and view the latest data.

    Figure 1 Synchronizing cluster policies

  6. Click Manage Policy in the Operation column of a cluster using the container tunnel network model.
  7. Click Create from YAML above the policy list.
  8. On the YAML creation page, enter content or click Import.

    The following is an example of a network policy created using YAML. The network policy requires that a pod can only be accessed by pods with specific labels and can only access specific pods.

    apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: access-demo4
  namespace: default
spec:
  policyTypes:
  - Ingress
  - Egress
  podSelector:                  # The rule takes effect for pods with the role=db label.
    matchLabels:
      role: db
  ingress:                      # Ingress rule
  - from:
    - podSelector:              # Only allow the access of the pods labeled with role=frontend.
        matchLabels:
          role: frontend
    ports:                      # Only TCP can be used to access port 6379.
    - protocol: TCP
      port: 6379
  egress:                       # Egress rule
  - to:
    - podSelector:              # Only pods with the role=web label can be accessed.
        matchLabels:
          role: web

  9. Click OK.

    You can view the new policy in the policy management list.

  1. Log in to the HSS console.
  2. Click in the upper left corner and select a region or project.
  3. In the navigation pane on the left, choose Container Protection > Container Firewalls.
  4. (Optional) If you have enabled the enterprise project, select the enterprise project where the target server resides from the drop-down list.
  5. Click Synchronize above the cluster list to synchronize the policies created on clusters.

    The synchronization takes about 1 to 2 minutes. Wait for a while and click in the upper right corner of the list to refresh and view the latest data.

    Figure 2 Synchronizing cluster policies

  6. Click Manage Policy in the Operation column of a cluster using the container tunnel network model.
  7. Click Create Network Policy above the network policy list.

    • Policy Name: Enter a network policy name.
    • Namespace: Select the namespace of the network policy.
    • Selector: Enter a key and a value to set the pod to be associated, and click Add. You can also click Reference Workload Label to reference the label of an existing workload.
    • Inbound rule: Click Add Rule in the Inbound Rules area. For more information, see Table 1.
      Table 1 Adding an inbound rule

      Parameter

      Description

      Protocol & Port

      Enter the inbound protocol type and port number of the pods to be associated. Currently, TCP and UDP are supported. If this parameter is not specified, all access traffic is allowed.

      Source Namespace

      Select a namespace whose objects can be accessed. If this parameter is not specified, access to the objects that belong to the same namespace as the current policy is allowed.

      Source Pod Label

      Select a label. Pods with this label can be accessed. If this parameter is not specified, all pods in the namespace can be accessed.
    • Outbound rule: Click Add Rule in the Outbound Rules area. For more information, see Table 2.
      Table 2 Adding an outbound rule

      Parameter

      Description

      Protocol & Port

      Enter the port and protocol of destination objects. If this parameter is not specified, access is not limited.

      Destination CIDR Block

      Configure CIDR blocks. This parameter allows requests to be routed to a specified CIDR block (and not to the exception CIDR blocks).

      Separate the destination and exception CIDR blocks by vertical bars (|), and separate multiple exception CIDR blocks by commas (,).

      For example, 172.17.0.0/16|172.17.1.0/24,172.17.2.0/24 indicates that 172.17.0.0/16 is accessible, but not for 172.17.1.0/24 or 172.17.2.0/24.

      Destination Namespace

      Namespace where the destination object is located. If not specified, the object belongs to the same namespace as the current policy.

      Destination Pod Label

      Select a label. Pods with this label can be accessed. If this parameter is not specified, all pods in the namespace can be accessed.

  1. Click OK.

    You can view the new policy in the policy management list.

Related Operations

Modifying or deleting a network policy

  1. (Optional) If you have enabled the enterprise project, select the enterprise project where the target server resides from the drop-down list.
  2. Click Manage Policy in the Operation column of a cluster using the container tunnel network model.
  3. Click Synchronize above the network policy list.

    The synchronization takes about 1 to 2 minutes. Wait for a while and click in the upper right corner of the list to refresh and view the latest data.

  4. Manage policies as needed.

    • Modifying a policy
      • In the Operation column of a policy, click Edit YAML. On the YAML page, modify the YAML content and click OK.
      • In the Operation column of a policy, click Update. Modify the network policy information and click OK.
    • Deleting a policy
      • In the Operation column of a policy, click Delete. In the confirmation dialog box, click OK.
      • Select one or multiple policies and click Delete above the policy list. In the displayed dialog box, click OK.

Parent Topic: Container Firewalls