Enabling Container Cluster Protection

Container cluster protection can perform security checks on cluster resources (including pods, Deployment, ReplicaSet, CronJob, and Service) before they are created or updated, and generate alarms or block insecure resources. You can enable protection to enhance cluster defense and protect containers.

After container cluster protection is enabled, you need to configure a policy to make the protection take effect. For more information, see Configuring a Container Cluster Protection Policy.

1. Log in to the management console.
2. Click in the upper left corner and select a region or project.
3. In the upper left corner of the page, click and choose Security > Host Security Service.

4. In the navigation pane, choose Container Protection > Container Cluster Protection.
5. Click the Protected Clusters tab.
6. Click Synchronize to synchronize clusters.
7. Click Enable in the Operation column of a cluster.

   To enable protection for clusters in batches, select clusters and click Enable Protection in the upper left corner of the cluster list.

   Caution

   • After container cluster protection is enabled for a cluster, the policy management plug-in (Gatekeeper and cgs-provider) will be installed in the cluster and occupy some cluster resources.
   • When enabling protection for a container cluster, do not perform any operation on the cluster. Otherwise, protection will fail to be enabled.

8. Click OK.

   If the Protection Status of the container cluster is Enabled but not configured, it indicates protection has been configured for the cluster and the policy management plug-in has been installed, but HSS has not started to protect your cluster. In this case, you need to configure a protection policy. For more information, see Configuring a Container Cluster Protection Policy.