Because new Elastic Compute Service (ECS) instances and network interfaces now have source/destination IP check enabled by default, which impacts container network connectivity in clusters that use the Terway and Flannel network plugins, Alibaba Cloud Container Service for Kubernetes (ACK) will disable the source/destination IP check by default for new ECS instances created in clusters starting at 00:00 on April 22, 2025.
Impact Scope
Clusters running versions of the Cloud Controller Manager and Terway network components lower than the versions specified in the solution below may experience container network connectivity issues.
Follow the steps in Source/Destination Check to confirm whether the source/destination IP check is disabled on the network interface of any new ECS instance created in your ACK cluster after 00:00 on April 22, 2025.
Solution
ACK has updated its relevant components to disable the source/destination IP check by default for new ECS instances created in clusters. Upgrade these components to the required versions during off-peak hours. For upgrade instructions, see Components.
If your cluster runs Kubernetes version earlier than 1.24, first upgrade your cluster to version 1.24 or later.
For clusters running Kubernetes 1.24 or later, upgrade the Cloud Controller Manager component to version v2.10.4 or later.
For clusters using the terway-eniip or terway-eni network plugin, also upgrade Terway to the corresponding version based on your Kubernetes version:
Kubernetes Version Range
Minimum Required Terway Version
≥ 1.31
v1.13.6
1.30
v1.9.14
1.24, 1.26, 1.28
v1.8.17
If you have questions about this change, submit a ticket to contact us.