If an Elastic Compute Service (ECS) instance or a Container Service for Kubernetes (ACK) cluster does not have a public IP address, you can create an SNAT entry in the virtual private cloud (VPC) where the ECS instance or ACK cluster is deployed to enable Internet access. If SNAT is disabled when you create a cluster, you can enable SNAT in the ACK console after the cluster is created. This topic describes how to enable SNAT for ACK clusters in the ACK console. SNAT allows ACK clusters to access the Internet.
Background information
You cannot call API operations to enable SNAT for existing clusters. For more information about SNAT, see What is NAT Gateway?.
Procedure
The following figure shows the steps to enable SNAT for an existing ACK cluster to access the Internet.

- Creates a NAT gateway. After you create the NAT gateway, a route entry is automatically added to the route table of the VPC where the NAT gateway is created. The destination CIDR block of the route entry is 0.0.0.0/0 and the next hop is the NAT gateway. This ensures that traffic is routed to the NAT gateway.Important By default, the route entry is automatically created for the first NAT gateway in a VPC. You must manually configure route entries for other NAT gateways if multiple NAT gateways are created in the VPC. For more information, see Add and delete routes.
- Create an elastic IP address (EIP). In the left-side navigation pane, choose Elastic IP Addresses page, click Create EIP.. On the
If you already have an EIP, skip this step.
- Associate the EIP with the created NAT gateway.
- On the NAT Gateway page, find the NAT gateway you created and choose in the Actions column.
- In the Associate EIP dialog box, select a resource group from the Resource Group drop-down list and select the EIP that you created from the Select Existing EIPs drop-down list.
- Click OK.
- Create an SNAT entry on the NAT gateway. After the SNAT entry is created and SNAT rules are configured, SNAT is enabled for the cluster. You can log on to the NAT Gateway console to view the details of the NAT gateway, such as the EIPs used by SNAT. The following figure shows a NAT gateway that is created for a cluster that uses the Terway network plug-in. SNAT rules are configured to enable the cluster to access the Internet.Click the name of the NAT gateway. On the SNAT Management tab of the gateway details page, you can check whether public IP addresses are associated with the vSwitches used by the cluster. The following figure shows the SNAT entries created for a cluster that uses the Terway network plug-in.
Result
Log on to a node of the cluster and access the Internet to verify that the node can access the Internet and no packet loss occurs during data transmission.
