Network Configuration

Availability

Network configuration is not yet available. This document describes the configuration rules.

Network configuration manages an environment's network access policies, including public access control and source VPC restrictions. The two policies apply independently and can be configured separately.

Configuration Entry

Select the target environment in the CloudBase console, then go to "Environment Management → Network Configuration".

Public Access Control

The "Public Access" switch controls whether the environment can be accessed through public entry points, including default and custom domains:

Switch State	Access Rule
On	Allows access to the environment through public entry points
Off	Disables public entry points governed by this policy while retaining VPC access; the legacy domains using the old CDN listed below are exceptions

Turn off "Public Access" in the "Public Access Control" section to restrict public access through the governed entry points.

Legacy Environment Exceptions: Public Access Remains Available

Default domains in some legacy environments use the old CDN, and their requests bypass the CloudBase gateway. These domains are not governed by the "Public Access" switch and remain publicly accessible when it is off.

Resource (Using the Old CDN)	Default Domain Pattern
Legacy Static Hosting	*.tcloudbaseapp.com
Legacy Cloud Storage	*.tcb.qcloud.la

Whether the switch applies depends on the request path, not just the domain suffix.

Turning off this switch does not disable public access to all resources or replace their resource-level access permission settings.

Verify Private Access Before Disabling Public Access

Disabling public access blocks existing public requests governed by this switch. Establish a VPC access connection first and verify that access works from within the VPC.

Disabling public access does not automatically establish a VPC connection. For private connectivity options, see Access CloudBase from Your Private Network.

VPC Access Control

The source VPC allowlist restricts which VPCs can access the environment. It controls access sources but does not establish network connections.

Allowlist State	Access Rule
Disabled	Does not restrict source VPCs; VPCs with established access connections can access the environment
Enabled	Only source VPCs in the allowlist can access the environment; requests from other VPCs are denied

Configure the Allowlist

1. Click "Add VPC" in the "VPC Access Control" section.
2. Add the source VPCs that are allowed to access the environment and verify their VPC IDs in the list.
3. Turn on "Enable Allowlist" to apply the source restrictions.

Manage the Allowlist

• Delete: Click "Delete" for a VPC to remove its entry.
• Clear: Click "Clear" to remove all VPCs from the list.
• Disable: Turn off "Enable Allowlist" to stop restricting source VPCs.

While the allowlist is enabled, removing a VPC revokes access from that source. Before removing a VPC, confirm that it no longer hosts workloads that need to access the environment.

Policy Combinations

The table below applies only to entry points governed by the network policies. The legacy domains listed above that use the old CDN and bypass the CloudBase gateway remain publicly accessible.

Public Access	VPC Allowlist	Access Scope
On	Disabled	Allows public access without restricting source VPCs
On	Enabled	Allows public access; VPC access is limited to allowlisted sources
Off	Disabled	Disables governed public entry points without restricting source VPCs
Off	Enabled	Disables governed public entry points; only allowlisted source VPCs can access the environment

Allowing network access does not bypass authentication or resource permission checks. Requests must still meet the existing authentication and authorization requirements after the network policies allow them.