Configuration varies by network plugin (Terway or Flannel), IP stack type, and destination.
Before you begin
If a pod cannot reach its destination, check these three areas first.
DNS resolution
Pods resolve destination hostnames through the cluster DNS before network policies take effect. If resolution fails, troubleshoot DNS errors first.
Network policies
Check whether a NetworkPolicy in the pod's namespace blocks outbound traffic. If so, update the policy to allow the required traffic. See Use network policies in ACK clusters.
Security groups
Security groups apply at the node level to Elastic Compute Service (ECS) instances hosting your pods. Verify both the cluster and ECS instance security groups:
-
An outbound rule allows traffic from the pod to the destination address and port.
-
No outbound rule blocks traffic to the destination address and port.
Access the internet
IPv4 single-stack clusters
Pods in an IPv4 single-stack cluster use private IPv4 addresses and can reach only public IPv4 destinations. Enable outbound access by associating an Elastic IP Address (EIP) with the pod or configuring a NAT gateway.
Configuration differs by network plugin:
| Internet access method | Terway | Flannel |
|---|---|---|
| NAT gateway | The SNAT rule must cover the pod's IP address. The pod's public IP is the NAT gateway's EIP. | The SNAT rule must cover the node's IP address. The pod's public IP is the NAT gateway's EIP. |
| EIP | Associate an EIP directly with the pod. See Associate an exclusive EIP with a pod. | Associate an EIP with the ECS node hosting the pod. The pod's public IP is the node's EIP. See Associate or disassociate an EIP. |
To configure a NAT gateway for either plugin, see Enable an existing ACK cluster to access the internet.
Dual-stack clusters
Dual-stack pods have private IPv4 and public IPv6 addresses, but IPv6 has no public bandwidth by default. To enable IPv6 internet access, see Allocate IPv6 internet bandwidth to a pod.
Access resources in a VPC
When a pod accesses Virtual Private Cloud (VPC) resources such as ECS instances, Server Load Balancer (SLB) instances, OSS buckets, or ApsaraDB RDS databases, the source IP seen by the destination depends on the network plugin:
-
Terway: The source IP is the pod's IP address.
-
Flannel: The source IP is the ECS node's IP address.
If the destination has access control rules — such as security group rules, Access Control List (ACL) rules, or IP whitelists — that block the source IP, add the appropriate IP address to the allowlist:
-
For Terway clusters: add the pod's IP address.
-
For Flannel clusters: add the ECS node's IP address.
Automate allowlist configuration across Alibaba Cloud services with ack-kubernetes-webhook-injector. See Dynamically configure a pod whitelist for an Alibaba Cloud service.
Access a LoadBalancer Service within the cluster
When a pod accesses an SLB instance fronting a LoadBalancer Service in the same cluster, ACK routes traffic directly to the backend pod, bypassing the SLB instance.
Exception: clusters running Terway 1.1.0 or earlier in IPVLAN + eBPF mode route traffic through the SLB instance's IP. From Terway 1.2.0, newly created clusters support intra-cluster load balancing; upgraded clusters do not.
See How do I enable load balancing within a cluster in Terway IPVLAN mode?.