This topic describes how to set isolation levels for single-tenant fully managed services and describes each isolation level.
Background information
In the single-tenant deployment mode for fully managed services, service providers often need to implement different levels of data isolation to control the scope of data. Compute Nest provides three isolation levels: account isolation, VPC isolation, and cloud resource isolation. This topic describes these three isolation levels and their requirements.
Isolation levels
Compute Nest provides three isolation levels: account isolation, VPC isolation, and cloud resource isolation.
Account isolation
A resource directory helps service providers establish a directory structure that reflects their business relationships. You can use a resource directory to organize multiple accounts into a multi-level hierarchy. This structure allows for the central management of accounts and resources. It helps you meet unified control requirements for aspects such as network deployment, bill settlement, user permissions, security compliance, and log auditing. For more information, see What is a resource directory?.
In account isolation, each service instance is deployed in a separate member account of a resource directory. When you create a service instance, a member account is created first. Before you can use a member account, you must enable Resource Directory. For more information about how to enable Resource Directory, see Enable a resource directory.
For more information about how to deploy service instances using this isolation method and perform related operations, see Fully managed services support account isolation.
VPC isolation
In VPC isolation, each service instance is deployed in a separate VPC. To use this isolation level, you must create a new VPC and vSwitch in the service template. This ensures that the networks of different users are isolated. Users cannot call each other over the private network.
Cloud resource isolation
In cloud resource isolation, service instances within the same VPC are isolated by deploying them to different cloud resources. Common methods include security group isolation, container cluster isolation, and container namespace isolation.
Security group isolation: Different service instances are deployed to different security groups. By default, different security groups are isolated from each other over the private network. This provides network isolation between service instances.
Container cluster isolation: A new container cluster is created for each service instance. This prevents resource-level interference between service instances.
Container namespace isolation: Service instances share a container cluster but are isolated by being deployed into different namespaces. This isolation method is relatively weak and may lead to issues such as resource contention or inadequate network isolation. To enhance isolation, you must configure namespace resource thresholds and network access policies.
Set the isolation level
Before you create a single-tenant fully managed service, you must first enable Resource Directory. For more information, see Enable a resource directory.
Log on to the Compute Nest console.
In the navigation pane on the left, choose My Services. On the My Services page, click Create Service. Select Create Custom Service and then select Fully Managed Service.
On the Create Service page, configure the service information.
For Isolation Level, select an isolation level and then configure the other parameters. For more information, see Create a fully managed service.
If you select Account Isolation or VPC Isolation as the isolation level, you must configure a new VPC and vSwitch in the service template. You can edit your template as shown in the following example:
ROSTemplateFormatVersion: '2015-09-01' Description: en: New VPC zh-cn: New VPC Parameters: ZoneId: Type: String AssociationProperty: ALIYUN::ECS::Instance:ZoneId Label: en: Zone ID zh-cn: Zone Required: true Default: null VpcCidrBlock: Type: String Label: en: VPC CIDR IPv4 Block zh-cn: VPC IPv4 CIDR block Description: zh-cn: The IP address range of the VPC.<br>You can use the following IP address ranges or their subnets:<br><font color='green'>[10.0.0.0/8]</font><br><font color='green'>[172.16.0.0/12]</font><br><font color='green'>[192.168.0.0/16]</font> en: 'The IP address range of the VPC.<br>You can use the following IP address ranges and their subnets: <br><font color=''green''>[10.0.0.0/8]</font><br><font color=''green''>[172.16.0.0/12]</font><br><font color=''green''>[192.168.0.0/16]</font>' Default: 192.168.0.0/16 Required: true AssociationProperty: ALIYUN::VPC::VPC::CidrBlock VSwitchCidrBlock: Type: String Label: en: VSwitch CIDR Block zh-cn: vSwitch subnet CIDR block Description: zh-cn: Must be a subnet of the VPC. en: Must be a subnet of the VPC. Default: 192.168.0.0/24 Required: true AssociationProperty: ALIYUN::VPC::VSwitch::CidrBlock AssociationPropertyMetadata: VpcCidrBlock: VpcCidrBlock Resources: Vpc: Type: ALIYUN::ECS::VPC Properties: CidrBlock: 192.168.0.0/16 VSwitch: Type: ALIYUN::ECS::VSwitch Properties: ZoneId: Ref: ZoneId VpcId: Ref: Vpc CidrBlock: 192.168.0.0/24Click Create Service, and then click OK in the confirmation dialog box.