Using a VPC Peering Connection to Connect CCE Clusters

Application Scenarios

Before creating an MCS object, ensure connectivity of both inter-cluster nodes and containers. You can create a VPC peering connection to connect CCE clusters across VPCs.

This section describes how you can create a VPC peering connection for connectivity of both inter-cluster nodes and containers.

Configuring Cluster Network Types

Creating a VPC Peering Connection

1. Go to the VPC peering connection list page.
2. In the upper right corner of the page, click Create VPC Peering Connection. In the displayed dialog box, configure parameters as prompted. For details about the parameters, see Table 2.
   Figure 1 Creating a VPC peering connection
   

   Table 2 Parameters for creating a VPC peering connection

   Parameter	Mandatory	Description
   VPC Peering Connection Name	Yes	Name of the VPC peering connection. The name can contain a maximum of 64 characters, including letters, digits, hyphens (-), and underscores (_).
   Local VPC	Yes	VPC of the local cluster. Select one from the drop-down list.
   Local VPC CIDR Block	Yes	CIDR block of the local VPC.
   Account	Yes	Select My account or Another account. In this example, My account is selected. My account: The local and peer VPCs are from the same account. Another account: The local and peer VPCs are from different accounts.
   Peer Project	Yes	The system fills in the corresponding project by default when Account is set to My account. For example, if two VPCs (VPC-A and VPC-B) are in account A in region A, the system fills in the corresponding project of account A in region A by default.
   Peer VPC	Yes	VPC of the peer cluster. Select one from the drop-down list.
   Peer VPC CIDR Block	Yes	CIDR block of the peer VPC. The local and peer VPCs cannot have identical or overlapping CIDR blocks. Otherwise, the routes added for the VPC peering connection may not take effect.
   Description	No	Description of the connection. Enter up to 255 characters. Angle brackets (< or >) are not allowed.

3. Click the VPC peering connection name. On the displayed page, click Add Route.
   As shown in Figure 2, you need to configure VPC CIDR blocks for local and peer clusters. For details, see Table 3.

   Figure 2 Adding a route
   

   Table 3 Route parameters

   Parameter	Mandatory	Description
   Destination	Yes	Enter the VPC CIDR block for the peer cluster. To query this CIDR block: Log in to the VPC console. In the navigation pane, choose Virtual Private Cloud > My VPCs. On the displayed page, locate the peer VPC and copy its IPv4 CIDR block. Figure 3 Querying the VPC CIDR block of the peer cluster
   Destination	Yes	Enter the VPC CIDR block for the local cluster. CAUTION: The destination of each route must be unique.
   Description	No	Supplementary information about the route. Enter up to 255 characters. Angle brackets (< or >) are not allowed.

4. On the VPC peering connection details page, click Add Route.

   As shown in Figure 4, you need to configure container CIDR blocks for local and peer clusters. For details, see Table 4.

   Figure 4 Adding a route
   

   Table 4 Route parameters

   Parameter	Mandatory	Description
   Destination	Yes	Enter the container CIDR block of the peer cluster. To query this CIDR block: Log in to the CCE console. Click the name of the target cluster to access the cluster console. In the Networking Configuration area, hover over the name of Default Pod Subnet and copy the IPv4 CIDR block. CAUTION: If there are multiple CIDR blocks, create a route for each CIDR block for communication between containers. Figure 5 Querying the container CIDR block of the peer cluster
   Destination	Yes	Enter the container CIDR block of the local cluster. CAUTION: The destination of each route must be unique.
   Description	No	Supplementary information about the route. Enter up to 255 characters. Angle brackets (< or >) are not allowed.

Changing a Security Group

Change the security group for the node in the local cluster to allow the node in the peer cluster to access over the local container port in the inbound rule.

Set Protocol & Port to the container port of the local cluster and Source to the IP address or CIDR block of the node in the peer cluster, as shown in Figure 6. For details about how to change the security group, see Changing the Default Security Group of a Node.

Figure 6 Changing a security group

Verifying Connectivity Between Clusters

1. Log in to the node in the local cluster and run the following command to verify the communication between the nodes in the local and peer clusters:

   ping IP address of the node in the peer cluster

   If the ping succeeds, the cluster connectivity is normal.

2. Access the container in the local cluster and run the following command to verify the communication between the containers in the local and peer clusters:

   curl IP address of the pod in the peer cluster

   If the access succeeds, the container connectivity is normal.