Container Service for Kubernetes:Expose the API server to the Internet with an EIP

Usage notes

• The associated EIP incurs charges based on the pay-as-you-go billing model. See What is EIP?

• Do not directly disassociate or release the associated EIP. Otherwise, the API server loses Internet access.

• Associating, disassociating, or changing the EIP triggers rolling updates on the API server. Do not operate on the cluster during rolling updates.

Associate an EIP during cluster creation

When you create a cluster, select Expose API server with EIP.

In the API Server Access section, select Expose API Server with EIP to bind an EIP to the API server's private CLB instance and enable public network access to the cluster API server.

See Create an ACK managed cluster, Create an ACK Serverless cluster, and Create an ACK Edge cluster.

Associate an EIP with an existing cluster

Supported in ACK managed, ACK Serverless, and ACK Edge clusters.

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the cluster name. In the left-side navigation pane, click Cluster Information.

3. On the Cluster Information page, click the Basic Information tab. In the Network section, click Associate EIP next to API server Public Endpoint.

4. Select an existing EIP or create an EIP in the cluster's region, and click OK.

The associated EIP appears in the API server Public Endpoint field.

Disassociate or change the EIP

Supported only in ACK managed and ACK Serverless clusters.

• Disassociate the EIP: The API server becomes accessible only over the internal network. In-cluster applications can still access it.

• Change the EIP: The API server's public endpoint changes accordingly.

To disassociate or change the EIP:

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the cluster name. In the left-side navigation pane, click Cluster Information.

3. On the Cluster Information page, click the Basic Information tab. In the Network section, click Change EIP or Unbind next to API server Public Endpoint.

Configure a network ACL for the API server

After exposing the API server to the Internet, configure a network access control list (ACL) for the API server to restrict access. Use a blacklist to block or a whitelist to allow specific IP addresses.

References

• To enable cluster applications to access Internet resources such as pulling images or updating dependencies, configure SNAT rules on a NAT gateway in the cluster's VPC.

• If the cluster security group has deny rules, verify that cluster protocols and ports are not blocked. See Configure security groups for clusters.