Container Compute Service:Security system overview

Policy management

ACS provides policy management through the Gatekeeper admission controller, which uses Open Policy Agent (OPA) policies. Four predefined rule libraries are included: Compliance, Infra, K8s-general, and PSP. Enable or customize security policies in the console to validate whether Pod creation and update requests are secure, and to automatically block non-compliant workloads at deployment time.

For more information, see Configure container security policies. For details about each rule library, see Predefined security policies of ACS.

Network policies

ACS provides policy-level network access control based on Kubernetes NetworkPolicy. Restrict inbound and outbound Pod traffic at the IP address or port level so that only the access paths required by your workloads are allowed, which reduces the lateral movement surface inside the cluster.

After you enable network policies, configure rules for specific applications in the console or by using kubectl. For more information, see Use network policies in ACS clusters.

Secure containers (secure sandbox)

The secure sandbox is an alternative container runtime that runs workloads inside a lightweight virtual machine with an independent kernel. This architecture provides stronger security isolation than standard containers, making it suited for untrusted application isolation, fault isolation, performance isolation, and multi-tenant workload separation. The secure sandbox has minimal performance overhead and delivers the same operational experience as Docker containers, including logging, monitoring, and autoscaling.

Security inspection

Application developers must follow the principle of least privilege when they configure deployment templates, because attackers often exploit unnecessary privileges granted to a Pod to escape the container. ACS inspects the security configuration of running applications so that you can identify configuration risks in real time.

Inspection results are presented as reports that explain each scanned item and provide remediation suggestions. You can also schedule periodic inspections and store the results in a Simple Log Service (SLS) Logstore. For more information, see security-inspector.

Image signing

Container Registry supports a content trust mechanism that lets image creators apply a digital signature to each image. Before deployment, ACS verifies image signatures to ensure that only trusted images run in the cluster. This prevents unexpected or malicious code from entering your environment and makes application images traceable throughout the deployment process.

Image scanning

Container Registry scans all Linux-based container images for known vulnerabilities and provides vulnerability assessments and fix suggestions to reduce security risks. The integrated cloud security scan engine identifies system vulnerabilities, application vulnerabilities, and malicious samples inside images.

Cloud-native application delivery chains (DevSecOps)

Container Registry provides a cloud-native application delivery chain for secure, efficient container delivery. Use it to configure image building, image scanning, global image synchronization, and image deployment, and to define fine-grained security policies — achieving full-link, observable, and traceable delivery. Code submitted once is securely distributed and efficiently deployed across multiple regions, upgrading your DevOps pipeline to DevSecOps. For more information, see Create a delivery chain.

Default security

ACS hardens cluster nodes and control plane components against CIS Kubernetes Benchmarks. All system components are hardened following container security best practices, ensuring that system component images contain no critical Common Vulnerabilities and Exposures (CVE) vulnerabilities.

Worker nodes of managed clusters operate under the principle of least privilege. Resource Access Management (RAM) users are granted only the minimal permissions required to access other cloud resources. For more information, see Authorization best practices.

Identity management

All communication between ACS cluster components requires TLS certificate verification, securing data transmission across the entire cluster. ACS automatically renews certificates for cluster system components. RAM users and roles can get a kubeconfig file to connect to the cluster API server through the console or OpenAPI. For specific operations, see Obtain cluster KubeConfig and connect to the cluster using kubectl. ACS maintains the identity information in access credentials and can revoke credentials when needed. For specific operations, see Revoke a cluster kubeconfig file.

Fine-grained access control

ACS implements Kubernetes resource access control using Role-Based Access Control (RBAC) — a foundational hardening measure for application security. The Authorizations page in the console provides fine-grained RBAC authorization at the namespace level, including:

• RBAC permission templates: Preset templates for administrator, operations, and developer roles based on different permission requirements.

• Batch authorization: Supports batch authorization across multiple clusters and multiple RAM users.

• RAM roles: Supports authorization for RAM roles.

• Custom ClusterRoles: Supports binding users to custom ClusterRoles within the cluster. For more information, see Configure RBAC permissions for RAM users or RAM roles.

Auditing

ACS is integrated with SLS to collect, query, and visualize cluster API server audit logs. Use these logs to record and trace the day-to-day operations of cluster users, and configure real-time alerts for operations on specific resource types. For more information, see Use the cluster API server auditing feature.

Secret encryption

By default, Kubernetes Secrets are stored in etcd encoded only in Base64 — not encrypted. In ACS clusters, you can encrypt Secrets using keys managed by Alibaba Cloud Key Management Service (KMS), protecting sensitive application data on disk. Automatically rotated keys are also supported. For more information, see Use Alibaba Cloud KMS to encrypt secrets at rest.