Enable Internet access for pods - Elastic Container Instance

By default, ECI pods are assigned only a private IP address. To pull images from a public registry like Docker Hub, or to expose a pod's service to the Internet, you need to give the pod a route to the Internet.

Two methods are available:

Associate an elastic IP address (EIP) with the pod — assigns a dedicated public IP address directly to the pod. Use this when a single pod needs its own public address (for example, to expose an NGINX service on port 80).
Create an Internet NAT gateway in the VPC — lets multiple pods share outbound Internet access through a single gateway. Use this when several pods need to reach the Internet but don't each need a dedicated public IP (for example, to pull Docker Hub images for multiple pods).

Important

Before enabling Internet access, make sure the relevant IP addresses and ports are allowed in the security group that the instances belong to. For details, see Add a security group rule.

Usage notes

Each EIP can be associated with a single elastic container instance (ECI) at a time. To give multiple pods their own public addresses, associate a separate EIP with each pod or use an Internet NAT gateway instead.
Annotations only take effect when you create an ECI pod. Adding or modifying annotations on an existing pod has no effect.
For Deployments, add annotations in the spec.template.metadata section, not at the top-level metadata.
If a pod has an associated EIP, the pod uses the EIP directly for outbound traffic and bypasses the SNAT feature of any NAT gateway in the VPC.

Associate an EIP with a pod

Add annotations to the pod's metadata section when creating the pod. You can either associate an existing EIP or let the system create one automatically.

Associate an existing EIP

Annotation	Example	Description
`k8s.aliyun.com/eci-eip-instanceid`	`"eip-bp1q5n8cq4p7f6dzu****"`	ID of the EIP to associate

Example: associate an existing EIP

apiVersion: apps/v1
kind: Deployment
metadata:
  name: test
  labels:
    app: test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      name: nginx-test
      labels:
        app: nginx
        alibabacloud.com/eci: "true"
      annotations:
        k8s.aliyun.com/eci-eip-instanceid: "eip-bp1q5n8cq4p7f6dzu****"    # ID of the existing EIP to associate
    spec:
      containers:
      - name: nginx
        image: registry.cn-shanghai.aliyuncs.com/eci_open/nginx:1.14.2
        ports:
        - containerPort: 80

Auto-create an EIP

Set k8s.aliyun.com/eci-with-eip to "true" to have the system create an EIP and associate it with the pod automatically. Use the following annotations to configure the EIP:

Annotation	Example	Description
`k8s.aliyun.com/eci-with-eip`	`"true"`	Creates and associates an EIP automatically
`k8s.aliyun.com/eip-bandwidth`	`"10"`	Maximum bandwidth in Mbit/s. Default: `5`
`k8s.aliyun.com/eip-internet-charge-type`	`PayByTraffic`	Metering method. Valid values: `PayByBandwidth` (pay-by-bandwidth), `PayByTraffic` (pay-by-traffic)
`k8s.aliyun.com/eip-isp`	`BGP`	Line type. Applies only to pay-as-you-go EIPs. Default: `BGP`. Valid values: `BGP` (BGP (Multi-ISP)), `BGP_PRO` (BGP (Multi-ISP) Pro). For details, see the "Line types" section of Elastic IP Addresses
`k8s.aliyun.com/eip-common-bandwidth-package-id`	`"cbwp-2zeukbj916scmj51m****"`	ID of an existing EIP bandwidth plan to associate with the EIP. For details, see What is Internet Shared Bandwidth?
`k8s.aliyun.com/eip-public-ip-address-pool-id`	`pippool-bp187arfugi543y1s****`	ID of the IP address pool from which the EIP is allocated. For details, see Create and manage IP address pools

Example: auto-create an EIP with a custom bandwidth

apiVersion: apps/v1
kind: Deployment
metadata:
  name: test
  labels:
    app: test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      name: nginx-test
      labels:
        app: nginx
        alibabacloud.com/eci: "true"
      annotations:
        k8s.aliyun.com/eci-with-eip: "true"      # Creates and associates an EIP automatically
        k8s.aliyun.com/eip-bandwidth: "10"        # Sets the maximum bandwidth to 10 Mbit/s
    spec:
      containers:
      - name: nginx
        image: registry.cn-shanghai.aliyuncs.com/eci_open/nginx:1.14.2
        ports:
        - containerPort: 80

Example: auto-create an EIP and associate it with an EIP bandwidth plan

apiVersion: apps/v1
kind: Deployment
metadata:
  name: test
  labels:
    app: test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      name: nginx-test
      labels:
        app: nginx
        alibabacloud.com/eci: "true"
      annotations:
        k8s.aliyun.com/eci-with-eip: "true"                                                  # Creates and associates an EIP automatically
        k8s.aliyun.com/eip-common-bandwidth-package-id: "cbwp-2zeukbj916scmj51m****"         # Associates an EIP bandwidth plan with the EIP
    spec:
      containers:
      - name: nginx
        image: registry.cn-shanghai.aliyuncs.com/eci_open/nginx:1.14.2
        ports:
        - containerPort: 80

For EIP pricing details, see Billing overview.

Create an Internet NAT gateway

A NAT gateway lets pods in a private VPC reach the Internet without a public IP address (SNAT), and optionally allows Internet traffic to reach specific pods (DNAT).

Feature	What it does
SNAT	Lets pods access the Internet using a shared EIP. No public IP address is assigned to individual pods
DNAT	Maps an EIP associated with the NAT gateway to a specific pod, so the pod can accept inbound Internet traffic

Step 1: Create an Internet NAT gateway

In the VPC console, create an Internet NAT gateway in the VPC where your pods run. For step-by-step instructions, see Create and manage an Internet NAT gateway.

For NAT gateway pricing, see Billing of Internet NAT gateways.

Step 2: Create an SNAT entry (outbound access)

Create an SNAT entry so pods can initiate connections to the Internet. For instructions, see Create and manage SNAT entries.

Pay attention to the following parameters:

Parameter	Description
SNAT entry	Determines which pods use SNAT. Select based on your network topology and security requirements: Specify VPC (all pods in the VPC), Specify vSwitch (pods connected to selected vSwitches), or Specify Custom CIDR Block (pods within a specific CIDR block)
Select vSwitch	Required when SNAT entry is set to Specify vSwitch. Select the vSwitches used by your pods
Custom CIDR block	Required when SNAT entry is set to Specify Custom CIDR Block. Enter the CIDR block that includes your pods
Select EIP	Select one or more EIPs associated with the NAT gateway. Pods use these EIPs to access the Internet

Step 3: Create a DNAT entry (inbound access)

Skip this step if your pods only need outbound Internet access.

To allow Internet traffic to reach a specific pod, create a DNAT entry. For instructions, see Create and manage DNAT entries.

Pay attention to the following parameters:

Parameter	Description
Select EIP	Select the EIP associated with the NAT gateway. Inbound traffic arrives at this EIP and is forwarded to the pod
Select Private IP Address	Identify the target pod by selecting its elastic network interface (ENI) or entering its private IP address
Port Settings	Select the forwarding method: Any Port (IP address mapping — all traffic to the EIP is forwarded to the pod) or Custom Port (port mapping — traffic on a specific protocol and port is forwarded to the corresponding port on the pod)

What's next

For EIP product details, see What is an EIP.
For NAT gateway product details, see What is NAT Gateway.