Container Service for Kubernetes:Enable an existing ACK cluster to access the Internet

Procedure

The following figure shows the steps to enable SNAT for an existing ACK cluster to access the Internet.

1. Creates a NAT gateway.
   1. Log on to the NAT Gateway console.
   2. In the left-side navigation pane, click NAT Gateway.
   3. On the NAT Gateway page, click Create NAT Gateway.
      For more information about NAT gateway parameters, see Create and manage Internet NAT gateways.

      Note The NAT gateway must be created in the region and VPC where your cluster resides.
   After you create the NAT gateway, a route entry is automatically added to the route table of the VPC where the NAT gateway is created. The destination CIDR block of the route entry is 0.0.0.0/0 and the next hop is the NAT gateway. This ensures that traffic is routed to the NAT gateway.

   Important By default, the route entry is automatically created for the first NAT gateway in a VPC. You must manually configure route entries for other NAT gateways if multiple NAT gateways are created in the VPC. For more information, see Add and delete routes.
2. Create an elastic IP address (EIP).
   In the left-side navigation pane, choose Elastic IP Addresses > Elastic IP Addresses. On the Elastic IP Addresses page, click Create EIP.

   If you already have an EIP, skip this step.

3. Associate the EIP with the created NAT gateway.
   1. On the NAT Gateway page, find the NAT gateway you created and choose > Bind Elastic IP Address in the Actions column.
   2. In the Associate EIP dialog box, select a resource group from the Resource Group drop-down list and select the EIP that you created from the Select Existing EIPs drop-down list.
   3. Click OK.
4. Create an SNAT entry on the NAT gateway.
   1. On the NAT Gateway page, find the gateway you created and click Manage in the Actions column.
   2. On the SNAT Management tab, click Create SNAT Entry.
   3. On the Create SNAT Entry page, set the parameters and click Confirm.
      For more information about SNAT entry parameters, see Create an SNAT entry.

      Parameter	Description
      SNAT Entry	Select Specify vSwitch and select the vSwitches that are used by the cluster. If the cluster uses the Terway network plug-in, select both the node vSwitches and pod vSwitches. If the cluster uses the Flannel network plug-in, select the node vSwitches. If the cluster uses the Flannel or Terway network plug-in, you can perform the following steps to view the IDs of the node vSwitches. Log on to the ACK console. In the left-side navigation pane of the ACK console, click Clusters. On the Clusters page, find the cluster that you want to manage. Then, click the name of the cluster or click Details in the Actions column. In the left-side navigation pane of the cluster details page, choose Nodes > Node Pools. Find the node pool that you want to manage and click Details in the Actions column. In the Node Configurations section, you can view the node vSwitch IDs in the Node vSwitch field. If the cluster uses the Terway network plug-in, you can perform the following steps to view the IDs of the pod vSwitches. Log on to the ACK console and click Clusters in the left-side navigation pane. On the Clusters page, click the name of a cluster and choose Configurations > ConfigMaps in the left-side navigation pane. On the top of the ConfigMap page, select kube-system for Namespace. Then, find and click the eni-config ConfigMap. On the eni-config page, you can view the pod vSwitch IDs in the vswitches field.
      Select NAT IP Address	Select one or more EIPs that you want to use to access the Internet.

   After the SNAT entry is created and SNAT rules are configured, SNAT is enabled for the cluster. You can log on to the NAT Gateway console to view the details of the NAT gateway, such as the EIPs used by SNAT. The following figure shows a NAT gateway that is created for a cluster that uses the Terway network plug-in. SNAT rules are configured to enable the cluster to access the Internet.

   Click the name of the NAT gateway. On the SNAT Management tab of the gateway details page, you can check whether public IP addresses are associated with the vSwitches used by the cluster. The following figure shows the SNAT entries created for a cluster that uses the Terway network plug-in.