Flannel is the default CNI for ACK Edge clusters using VXLAN mode. This topic describes dedicated-line and public-network access patterns and how to implement the cloud-edge O&M tunnel.
How Flannel allocates pod IPs
Flannel ensures the pod CIDR block does not overlap with the Virtual Private Cloud (VPC) CIDR block, divides it evenly across nodes, and assigns each pod an IP from its node's range. Total assignable IPs depends on the pod CIDR mask.
Network access types
ACK Edge clusters support two cloud-edge connection types, each with different networking constraints.
Express Connect circuits
Express Connect forwards requests from VPC hosts to data center workloads. Flannel uses VXLAN for network connectivity between data centers and the cloud.
Network requirements
| Protocol | Port | Usage |
|---|---|---|
| UDP | 8472 | Flannel VXLAN tunnel |
Do not use security rules to block port 8472.
Configure an on-cloud proxy node for API server access
To let the API server access pods or Services in data centers over Express Connect, designate an on-cloud node as a proxy.
Before you begin:
-
The edge-controller-manager component is version 2.1 or later.
Label an on-cloud node as the gateway. Replace node-xxx with the target node name.
kubectl label node node-xxx node-role.alibabacloud.com/cloud-gateway=Public network
With the public network type, VPC and data center devices are in separate network domains, creating these constraints:
| Constraint | Traffic direction | Reachable |
|---|---|---|
| VPC-to-edge | VPC containers to data center containers | No |
| Cross-site edge | Containers across multiple data centers or edge devices | No |
| Same-domain | Containers within the same VPC or the same data center | Yes |
For container monitoring, O&M, and data transmission across the cloud-edge boundary, ACK Edge provides the Raven tunnel.
Do not route business traffic through the Raven tunnel. The public network VPN tunnel cannot guarantee the stability required for production workloads.