If your applications in a Container Service for Kubernetes (ACK) cluster need to access external resources over the Internet, such as pulling images or updating dependency libraries over the Internet, you can configure SNAT rules on a NAT gateway in the virtual private cloud (VPC) where the cluster resides.
If you want to allow external access to the API server of an ACK cluster over the Internet, such as using kubectl to connect to the cluster over the Internet, you can associate an elastic IP address with the API server. For more information, see Control public access to the API server of a cluster.
Billing description
When you configure SNAT rules, the following cloud services are used:
NAT Gateway: provides fully managed NAT gateways that allow instances to access the Internet by using the network address translation feature. This avoids address exposure and improves network security. For more information about the billing rules of NAT Gateway, see Billing of Internet NAT gateways.
EIP: provides public IP addresses that can be purchased and held as independent resources. After you associate an EIP with a cloud resource, the cloud resource can use the EIP to access the Internet. For more information about the billing rules of EIP, see Pay-as-you-go.
Procedure
You can configure SNAT rules when you create an ACK cluster or after an ACK cluster is created. SNAT rules allow the cluster to use the EIP associated with the Internet gateway to access the Internet.
You cannot call API operations to enable SNAT for existing clusters.
Enable SNAT for existing clusters
The following figure shows the steps for enabling SNAT to allow an existing cluster to access the Internet.
Create a NAT gateway.
The NAT gateway must be created in the same region as the cluster.
Log on to the NAT Gateway console.
In the left-side navigation pane, choose NAT Gateway > Internet NAT Gateway.
On the Internet NAT Gateway page, click Create Internet NAT Gateway. Configure the parameters and click Buy Now. For more information about the NAT gateway parameters, see Create and manage an Internet NAT gateway.
ImportantWhen you create the first Internet NAT gateway in a VPC, the system automatically adds a route whose destination CIDR block is 0.0.0.0/0 and whose next hop is the Internet NAT gateway to the system route table of the VPC. This route is used to route traffic to the Internet NAT gateway. If the VPC has a custom route table or multiple Internet NAT gateways exist in the VPC, manually add routes based on your business requirements. For more information, see Create and manage a route table.
(Optional) Create an EIP. If you already have an EIP, skip this step.
In the left-side navigation pane, choose .
On the Elastic IP Addresses page, click Create EIP. On the Elastic IP page, select the region where the NAT gateway resides, configure other parameters, and then click Buy Now.
Associate the EIP with the NAT gateway.
In the left-side navigation pane, choose NAT Gateway > Internet NAT Gateway.
On the Internet NAT Gateway page, find the NAT gateway you created and choose
> Associate EIP in the Actions column. In the Associate EIP dialog box, select a resource group from the Resource Group drop-down list, select the EIP you created from the Select Existing EIP drop-down list, and then click OK.
Create a vSwitch-scoped SNAT entry on the NAT gateway
On the Internet NAT Gateway page, find the NAT gateway you created and click Manage in the Actions column.
On gateway details page, click the SNAT Management tab. On the SNAT Management tab, click Create SNAT Entry.
On the Create SNAT Entry page, set the parameters and click OK. For more information about SNAT entry parameters parameters, see Create an SNAT entry.
Parameter
Description
SNAT Entry
Select Specify vSwitch and select one or multiple vSwitches that are used by the cluster.
If the cluster uses the Terway network plug-in, select the node vSwitches and pod vSwitches.
If the cluster uses the Flannel network plug-in, select the node vSwitches.
Obtain node vSwitch IDs
Log on to the ACK console. In the left-side navigation pane, click Clusters.
On the Clusters page, find the cluster to manage and click its name. In the left-side navigation pane, choose .
On the Node Pools page, click the name of the node pool that you want to manage. On the node pool details page, click the Overview tab. In the Node Configurations section, you can view the IDs of the node vSwitches.
Obtain pod vSwitch IDs
On the Clusters page, find the cluster that you want to manage and click its name. In the left-side pane, choose .
In the upper part of the ConfigMap page, select kube-system from the Namespace drop-down list. Then, find and click the eni-config ConfigMap.
On the eni-config page, you can view the IDs of the pod vSwitches in the vswitches field.
Select EIP
Select one or more EIPs that you want to use to enable Internet access.
After the SNAT entry is created and SNAT rules are configured, SNAT is enabled for the cluster. You can log on to the NAT Gateway console to view the details of the NAT gateway, such as the EIPs used by SNAT. The following figure shows a NAT gateway that is created for an ACK cluster that uses the Terway network plug-in. SNAT rules are configured to enable the cluster to access the Internet.
Enable SNAT during cluster creation
Log on to the ACK console. When you create an ACK cluster, select Configure SNAT for VPC in the Network Settings section. For more information about how to create an ACK cluster in the ACK console, see Create an ACK managed cluster.
When you create the first Internet NAT gateway in a VPC, the system automatically adds a route whose destination CIDR block is 0.0.0.0/0 and whose next hop is the Internet NAT gateway to the system route table of the VPC. This route is used to route traffic to the Internet NAT gateway. If the VPC has a custom route table or multiple Internet NAT gateways exist in the VPC, manually add routes based on your business requirements. For more information, see Create and manage a route table.
Result
Log on to a node in the cluster and access the Internet to test whether the node can access the Internet and whether packet loss occurs during data transmission.
FAQ
How do I view the public IP address of an ACK cluster
Log on to the NAT Gateway console.
In the left-side navigation pane, choose NAT Gateway > Internet NAT Gateway.
On the Internet NAT Gateway page, find the NAT gateway you created and click Manage in the Actions column.
Click the SNAT Management tab. In the SNAT Entry List section, you can view the EIPs used by the cluster.
References
For more information about the usage notes for configuring a pod to access an external network, such as the usage notes for configuring domain name resolution, network policies, and security groups, see Notes for configuring a pod to access an external network.
For more information about the recommended cluster security group rules, see Configure security groups for clusters.
Do not configure SNAT entries and IPv4 gateways for an ACK cluster at the same time. For more information about how to configure an IPv4 gateway for nodes in an ACK cluster, see Use IPv4 gateway to centralize control over Internet access.