Accessing the Internet from a Container

Containers can access the Internet in either of the following ways:

• Bind an EIP to the node hosting the container.
• Bind an EIP to the target pod if the cluster uses a Cloud Native 2.0 network. For details, see Configuring an EIP for a Pod in a CCE Turbo Cluster.
• Configure SNAT rules through NAT Gateway.

NAT Gateway provides source network address translation (SNAT) for VPC pods, translating private IP addresses to the EIP's public IP address. Pods in the VPC share this EIP for Internet access. Figure 1 shows the SNAT architecture. SNAT allows the pods in a VPC to access the Internet without being bound to EIPs. SNAT supports a large number of concurrent connections, which makes it suitable for applications involving a large number of requests and connections.

Figure 1 SNAT

This section describes how to use a NAT gateway for Internet access.

1. Obtain an EIP.
   1. Log in to the EIP console.
   2. On the EIPs page, click Buy EIP.
   3. Configure parameters as required.
      

      Set Region to the region where container pods are located.

2. Create a NAT gateway.
   1. Click in the upper left corner and choose Networking > NAT Gateway in the expanded list.
   2. On the Public Network Gateways page, click Buy Public NAT Gateway in the upper right corner.
   3. Configure parameters as required.
      

      Select the same VPC.

3. Configure an SNAT rule and bind the EIP to the subnet.
   1. On the page displayed, click the name of the NAT gateway for which you want to add the SNAT rule.
   2. On the SNAT Rules tab, click Add SNAT Rule.
   3. Configure parameters as required.
   

   SNAT rules take effect by CIDR block. As different container network models use different communication modes, the subnet needs to be selected according to the following rules:

   • Tunnel network and VPC network: Select the subnet where the node is located, that is, the subnet selected during node creation.
   • Cloud Native Network 2.0: Select the subnet where the container is located, that is, the container subnet selected during cluster creation.

   If there are multiple CIDR blocks, you can create multiple SNAT rules or customize a CIDR block as long as the CIDR block contains the container subnet (Cloud Native Network 2.0) or the node subnet.

   After the SNAT rule is configured, workloads can access the Internet from the container. The Internet can be pinged from the container.