CCE Security Group

A security group, essentially a virtual firewall, defines access policies for Baidu Cloud Compute within the same virtual private cloud with similar security protection and trust requirements. It offers state detection and data packet filtering, helping to segment security domains in the cloud and serving as a key network security isolation measure.

You can control the ingress and egress traffic of Baidu Cloud Compute within a security group by configuring security group rules. For more introductions to security groups, please refer to Security Group.

Prerequisites for use

The Cloud Container Engine (CCE) introduces optimized security group usage for clusters. Users can choose to either "Automatically create a default security group" or "Use an existing security group." For general scenarios, it’s recommended to opt for the default security group, as it simplifies configuration without requiring detailed rule management and keeps costs low. For more specific needs, you can refer to the default group's rules to ensure proper inter-group communication, avoiding issues like cluster access failures caused by misconfigured group rules, which could affect cluster operations.

Description of CCE default security groups

As a general container platform, CCE sets security group rules applicable to general scenarios. When a cluster is created, separate security groups will be automatically created for master nodes and worker nodes. The name of the security group for master nodes is: {Cluster ID}-master-{Random ID}; the name of the security group for Worker nodes is: {Cluster ID}-worker-{Random ID}. For clusters using the VPC-ENI container network mode, an additional ENI security group will be created, named {Cluster ID}-eni-{Random ID}.

Default security group rules for workers

To ensure the normal operation of cluster and node functions and maintain normal network connectivity between clusters and nodes, the default security group rules for workers automatically created by CCE are as follows:

Default security group rules for ENI

In the "VPC-ENI" container network mode, to ensure normal network connectivity between Pods on cluster nodes, the default security group rules for ENI automatically created by CCE are as follows:

Default security group for masters

To ensure the normal operation of cluster and node functions and maintain normal network connectivity between clusters and nodes, the default security group rules for the master automatically created by CCE are as follows:

Default security group rules for IPv6 clusters

If the cluster enables an IPv6 dual-stack network, the following additional security group rules will be created for the cluster: