Security Center:Serverless security

ACK Serverless cluster

1. Log on to the Container Service for Kubernetes (ACK) console and go to the management page of the target cluster.

2. In the left navigation pane, choose Workloads > Pods, then click Create from YAML.

3. In the YAML template, add the following annotation under spec > template > metadata:

   annotations:
     k8s.aliyun.com/eci-aliyundun-enabled: 'true'

   Sample YAML:

   apiVersion: apps/v1 # for versions before 1.8.0 use apps/v1beta1
   kind: Deployment
   metadata:
     name: nginx-deployment-basic
     labels:
       app: nginx
   spec:
     replicas: 2
     selector:
       matchLabels:
         app: nginx
     template:
       metadata:
         annotations:
           k8s.aliyun.com/eci-aliyundun-enabled: 'true'
         labels:
           app: nginx
       spec:
       #  nodeSelector:
       #    env: test-team
         containers:
         - name: nginx
           image: nginx:1.7.9 # replace it with your exactly <image_name:tags>
           ports:
           - containerPort: 80
           resources:
             limits:
               cpu: "500m"

If you create a resource from an image instead of YAML, add the pod annotation k8s.aliyun.com/eci-aliyundun-enabled=true in the Advanced section. For details, see Create a stateless application from an image.

Managed or dedicated ACK cluster

1. Log on to the ACK console and go to the cluster management page. Deploy the ack-virtual-node component to schedule pods to ECI. For details, see Schedule a pod to an ECI.

2. In the left navigation pane, choose Workloads > Pods, then click Create from YAML: Sample YAML:

   • Under metadata: add the annotation k8s.aliyun.com/eci-aliyundun-enabled: "true"

   • Under spec > containers: set the environment variable ECI_CONTAINER_TYPE = sidecar

   apiVersion: v1
   kind: Pod
   metadata:
     name: test-aegis-alinux2-lifsea-x86
     labels:
       eci: "true"
     annotations:
       k8s.aliyun.com/eci-aliyundun-enabled: "true"
   spec:
     containers:
     - name: sidecar
       image: registry-vpc.cn-shanghai.aliyuncs.com/eci_open/centos:7
       command:
       - /bin/sh
       - -c
       args:
       - sleep inf
       env:
       - name: ECI_CONTAINER_TYPE
         value: sidecar
     - name: nginx
       image: registry-vpc.cn-shanghai.aliyuncs.com/eci_open/centos:7
       command:
       - /bin/sh
       - -c
       args:
       - sleep inf

ACS cluster

1. Log on to the Container Compute Service console and go to the management page of the target cluster.

2. In the left navigation pane, choose Workloads > Deployments, then click Create from YAML.

3. In the YAML template, add the following annotation under spec > template > metadata:

   annotations:
     security.alibabacloud.com/aliyundun-enabled: 'true'

   Sample YAML:

   apiVersion: apps/v1 # for versions before 1.8.0 use apps/v1beta1
   kind: Deployment
   metadata:
     name: nginx-deployment-basic
     labels:
       app: nginx
   spec:
     replicas: 2
     selector:
       matchLabels:
         app: nginx
     template:
       metadata:
         labels:
           app: nginx
           alibabacloud.com/compute-class: general-purpose
           alibabacloud.com/compute-qos: default
         annotations:
            security.alibabacloud.com/aliyundun-enabled: 'true'
       spec:
       #  nodeSelector:
       #    env: test-team
         containers:
         - name: nginx
           image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6 # replace it with your exactly <image_name:tags>
           ports:
           - containerPort: 80
           resources:
             limits:
               cpu: "500m"

If you create a resource from an image, add the pod annotation security.alibabacloud.com/aliyundun-enabled=true in the Advanced section. For details, see Create a resource from an image and Overview of ACS pods.

Free Edition or free trial users

1. Go to the Security Center purchase page and log on with your Alibaba Cloud account.

2. Set Billing Method to Pay-as-you-go and set Serverless Asset Protection to Pay-as-you-go.

3. Click Custom Quota Binding. In the dialog box, select All Servers or Specific Servers to configure which assets to authorize.

   Important

   Without custom binding, all assets are authorized by default, and new assets are automatically authorized going forward.

   

4. Read the Security Center Terms of Service, then click Order Now.

After the order completes, Security Center automatically connects to ECI instances and SAE applications in a Running state and attaches authorization based on your Authorization Management configuration.

Paid edition users (Anti-virus, Premium, Enterprise, or Ultimate)

1. Log on to the Security Center console.

2. In the left navigation pane, choose Assets > Container. In the upper-left corner, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.

3. On the Serverless Asset page, click Activate Now. Alternatively, turn on the Serverless Asset Protection switch in the Pay-as-you-go area on the right side of the Overview page.

4. In the confirmation dialog box, click Custom Quota Binding to select which assets to authorize, then click OK.

   Important

   Without custom binding, authorization follows this logic: - First time enabling: All assets are authorized by default, and new assets are automatically authorized. - Re-enabling: Previously authorized assets are reattached. If no ECI instances or SAE applications were authorized before, all assets are authorized by default, and authorization is automatically attached to new assets. - After clearing an overdue payment: Previously authorized assets are automatically reattached.

5. Select Security Center Service Level Agreement, then click Activate Now.