Enable Internet access for an existing ACK cluster - Container Service for Kubernetes

Prerequisites

Ensure the following:

An ACK cluster with node pools
The cluster's network plugin (Terway or Flannel) is identified, which determines which vSwitches need SNAT entries
Permissions to create and manage NAT gateways and elastic IP addresses (EIPs)

Billing

Configuring SNAT rules involves the following billable services:

Service	Description	Billing details
NAT Gateway	Fully managed NAT gateways that enable Internet access without exposing private IP addresses.	Billing of Internet NAT gateways
Elastic IP Address	Independent public IP addresses that you associate with cloud resources for Internet access.	Pay-as-you-go

Terway and Flannel: vSwitch requirements

The vSwitches that require SNAT entries depend on your cluster's network plugin.

Network plugin	Required vSwitches for SNAT	Reason
Terway	Node vSwitches and pod vSwitches	Terway assigns vSwitch-based IP addresses to pods, so both node and pod subnets need outbound routes.
Flannel	Node vSwitches only	Flannel uses overlay networking, so pod traffic exits through the node's network interface.

Enable SNAT for an existing cluster

Create a NAT gateway, associate an EIP, and add SNAT entries for the cluster's vSwitches.

API operations are not yet supported for enabling SNAT on existing clusters.

Overall workflow:

Workflow for enabling SNAT on an existing cluster

Step 1: Create a NAT gateway

Create an Internet NAT gateway in the same region as your cluster.

Log on to the NAT Gateway console.
In the left-side navigation pane, choose NAT Gateway > Internet NAT Gateway.
On the Internet NAT Gateway page, click Create Internet NAT Gateway.
Configure the parameters and click Buy Now. See Create and manage an Internet NAT gateway.

Important

Creating the first Internet NAT gateway in a VPC automatically adds a 0.0.0.0/0 route to the VPC's system route table with the gateway as the next hop. If your VPC uses a custom route table or has multiple Internet NAT gateways, add routes manually. See Create and manage a route table.

Step 2: Create an EIP (optional)

Skip this step if you already have an EIP.

In the left-side navigation pane, choose Access to Internet > Elastic IP Addresses.
On the Elastic IP Addresses page, click Create EIP.
Select the same region as your NAT gateway, configure the remaining parameters, and click Buy Now.

Step 3: Associate the EIP with the NAT gateway

In the left-side navigation pane, choose NAT Gateway > Internet NAT Gateway.
On the Internet NAT Gateway page, find your NAT gateway and choose > Associate EIP in the Actions column.
In the Associate EIP dialog box, select a resource group from Resource Group, select the EIP from Select Existing EIP, and click OK.

Step 4: Create SNAT entries

On the Internet NAT Gateway page, find your NAT gateway and click Manage in the Actions column.
On the gateway details page, click the SNAT Management tab and click Create SNAT Entry.

On the Create SNAT Entry page, configure the following parameters and click OK. See Create an SNAT entry.

Parameter	Description
SNAT Entry	Select Specify vSwitch and select the vSwitches used by your cluster. For Terway clusters, select both node vSwitches and pod vSwitches. For Flannel clusters, select only node vSwitches.
Select EIP	Select one or more EIPs for outbound Internet access.

After the SNAT entry is created, your cluster can access the Internet through the NAT gateway.

NAT gateway with SNAT rules for a Terway-based ACK cluster:

NAT gateway with SNAT rules configured

Find your cluster's vSwitch IDs

Find node vSwitch IDs

Log on to the ACK console. In the left-side navigation pane, click Clusters.
On the Clusters page, click the target cluster name. In the left-side navigation pane, choose Nodes > Node Pools.
On the Node Pools page, click a node pool name. Click the Overview tab. In the Node Configurations section, find the node vSwitch IDs.

Find pod vSwitch IDs (Terway only)

On the Clusters page, click the target cluster name. In the left-side navigation pane, choose Configurations > ConfigMaps.
On the ConfigMap page, select kube-system from Namespace. Click the eni-config ConfigMap.
On the eni-config page, find the vswitches field for the pod vSwitch IDs.

Enable SNAT during cluster creation

For a new cluster, enable SNAT during creation:

Log on to the ACK console.
Select Configure SNAT for VPC in the Network Settings section. See Create an ACK managed cluster.

Configure SNAT for VPC option during cluster creation

Important

Creating the first Internet NAT gateway in a VPC automatically adds a 0.0.0.0/0 route to the VPC's system route table with the gateway as the next hop. If your VPC uses a custom route table or has multiple Internet NAT gateways, add routes manually. See Create and manage a route table.

Verify Internet access

Run these commands on a cluster node to confirm connectivity.

Log on to a node in the cluster.
Test Internet connectivity:
```
   ping -c 4 www.alibabacloud.com
```
Verify that the outbound IP matches your EIP:
```
   curl ifconfig.me
```

Connectivity test result

FAQ

How do I find the public IP address used by my ACK cluster?

Log on to the NAT Gateway console.
In the left-side navigation pane, choose NAT Gateway > Internet NAT Gateway.
On the Internet NAT Gateway page, find the NAT gateway associated with your cluster and click Manage in the Actions column.
Click the SNAT Management tab. In the SNAT Entry List section, view the EIPs used by the cluster.

EIPs in the SNAT Entry List

References

See Notes for configuring a pod to access an external network.
For recommended security group rules, see Configure security groups for clusters.
Do not configure SNAT entries and IPv4 gateways for an ACK cluster at the same time. See Use IPv4 gateway to centralize control over Internet access.