Container Service for Kubernetes:Container security FAQ

Why is there no network connectivity between containers?

Two security group misconfigurations typically cause this issue.

Cause 1: The inbound rule for Pod Network CIDR was deleted

The required rule allows all traffic from the pod CIDR block. Without it, inter-container communication fails.

Solution: Add back the missing rule.

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, find the target cluster and click its name. In the left navigation pane, click Cluster Information.

3. On the Cluster Information page, click the Basic Information tab. Click the link next to Control Plane Security Group to open the security group page in the ECS console.

4. On the Security Groups page, click the Inbound tab, then click Add Rule. In the dialog box, configure the rule and click Submit.

   Field	Value
   Action	Allow
   Priority	Default
   Protocol	All Traffic
   Source	Pod CIDR block (find this under Pod Network CIDR in the Network section on the cluster details page)

Cause 2: A new ECS instance is in a different security group than the cluster

Solution: Get the cluster's security group ID from the Basic Information tab > Security Group field, then add the ECS instance to that security group. For details, see Add an instance to, remove an instance from, or switch the security group for an instance.

How do I specify a security group for a Kubernetes cluster?

When creating a cluster

ACK automatically creates a default security group during cluster creation. To use custom rules, modify this security group after creation. For more information, see Configure a cluster security group.

For an existing cluster

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, find the target cluster and click its name. In the left navigation pane, click Cluster Information.

3. On the Cluster Information page, click the Basic Information tab. In the Network section, click Edit next to Control Plane Security Group.

4. In the dialog box, select the security group and click OK.

Can the cluster audit feature be disabled or enabled after a cluster is created?

Yes. For more information, see Use the cluster API server audit feature.

How do I change the certificate validity period and replace component certificates for an ACK Dedicated cluster?

ACK sends internal messages and notifications about two months before your cluster certificate expires. After receiving the notification, go to the Clusters page in the console and click the update button. For more information, see Update an expiring certificate for an ACK dedicated cluster.

If the certificate has already expired, see Update an expired certificate for an ACK dedicated cluster.

Why can't I create a pod, and why does the error "no providers available to validate pod request" appear?

If you have not configured a custom Pod Security Policy (PSP), this error occurs because the default PSP was deleted. Restore the default PSP rules to resolve it. For details, see \[Deprecated\] Use Pod Security Policies.

To configure a custom PSP instead, see Enable security policy management.

Why can't I use a Secret in a new namespace?

Secrets are namespace-scoped — each namespace maintains its own isolated set of Secrets, and pods can only access Secrets in the same namespace.

To use a Secret in a new namespace, create the Secret directly in that namespace.

Why can't I mount the default-token?

Cause: The systemd version on the node is too old.

The error message looks like this:

Normal Scheduled 13m default-scheduler Successfully assigned dev/alibaba-demo-67fcdbfb8-zklnp to cn-hangzhou.10.7.3.16  Warning FailedMount 13m (x2 over 13m) kubelet, cn-hangzhou.10.7.3.16 MountVolume.SetUp failed for volume 'default-token-8twx9' : mount failed: exit status 1 Mounting command: systemd-run Mounting arguments: --description=Kubernetes transient mount for /var/lib/kubelet/pods/62d39b35-9a4d-11ea-9870-c24d56a0e904/volumes/kubernetes.io~secret/default-token-8twx9 --scope -- mount -t tmpfs tmpfs /var/lib/kubelet/pods/62d39b35-9a4d-11ea-9870-c24d56a0e904/volumes/kubernetes.io~secret/default-token-8twx9 Output: Failed to start transient scope unit: Argument list too long  Warning FailedCreatePodContainer 3m40s (x49 over 13m) kubelet, cn-hangzhou.10.7.3.16 unable to ensure pod container exists: failed to create container for [kubepods burstable pod62d39b35-9a4d-11ea-9870-c24d56a0e904] : Argument list too long

Use either of the following fixes:

• Upgrade systemd. For more information, see the GitHub comment on kubernetes/kubernetes #57345.

• Run sudo systemctl daemon-reload to restart and reset the daemon. For more information, see the GitHub comment on kubernetes/kubernetes #57345.

How do I query audit logs?

Audit logs are stored in Simple Log Service (SLS). To open the Logstore:

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, find the target cluster and click its name. In the left navigation pane, click Cluster Information.

3. On the Cluster Information page, click the Basic Information tab. Click the link next to Log Service Project to open the SLS console.

4. On the Log Storage > Logstores page, select the audit-<cluster_id> Logstore and click Search & Analyze in the upper-right corner.

5. Select a time range that covers the period from when the system was working correctly to when the issue occurred — for example, 3 days, 7 days, or 15 days.

6. In the Search & Analyze text box, enter a query and click Search & Analyze.

7. To download the results, click the icon and select Download Log. Configure the download settings in the dialog box and click OK.

requestURI: "rbac.authorization.k8s.io" not (verb: get or verb: watch)

requestURI: "configmaps" and <configmap_name> not (verb: get or verb: watch or verb: list)

requestURI: deployments and (verb: update or verb: patch) and replicas and deployments and <deployment_name> not deployment-controller