Network Management

How Do I View the VPC CIDR Block?

On the home page of the VPC console, view Name and IPv4 CIDR Block of VPCs. You can modify the CIDR block of a VPC or create a new one.

Figure 1 Viewing the VPC CIDR blocks

Does CCI Support Load Balancing?

CCI supports load balancing. When creating a workload on the CCI console, you can choose to use ELB for both access over the private network or public network. For details, see Workload Access Through a Private Network Load Balancer.

CCI works with ELB for load balancing. Generally, load balancers are used to route the traffic from the public network to pods.

After creating a workload on CCI, you can create a Service and configure a load balancer for private or public network access.

1. Public network load balancer: For details, see Public Network Access.
2. Private network load balancer: For details, see Private Network Access.

How Can a Container Access the Public Network?

Load balancers can be used to route traffic to pods. If a load balancer has an EIP bound, the pods can be accessed from the public network. For details, see Public Network Access.

How Do I Access the Public Network from a Container?

apiVersion: cci/v2
kind: Pod
metadata:
  labels:
    app: nginx
  name: 'nginx'
  annotations:
    yangtse.io/pod-with-eip: 'true'
spec:
  containers:
    - image: xxxxxx
      name: container-0
      resources:
        requests:
          cpu: 500m
          memory: 1Gi

After the workload runs normally, you can access the public network from the container.

What Do I Do If Access to a Workload from a Public Network Fails?

1. A workload must be in the running state before it can be accessed from a public network. If the workload is abnormal or not ready, it cannot be accessed from a public network.
2. It may take one to three minutes from the time when the workload is created to the time when it is ready for access from the public network. During this time period, network routes have not yet been configured. As a result, the workload cannot be accessed from the public network.
3. If a workload is inaccessible three minutes after it is created, a possible cause is that the container port is not being listened to. You need to use the image to check whether the container port is being listened to. If the container port is being listened to, the access failure may be caused by the load balancer. In this case, you need to check the load balancer.

What Do I Do If 504 Is Returned When I Access a Workload?

This is because security group rules do not allow traffic to the pods running in CCI over the listener's port of the load balancer. Check the security group associated with the pods and ensure that security group rules allow traffic to the pods running in CCI over the listener's port of the load balancer.

1. Query the security group associated with the pods by calling the API for querying a network. spec.securityGroups in the response is the security group ID.

   {
       "apiVersion": "yangtse/v2",
       "kind": "Network",
       "metadata": {
           "annotations": {
               "yangtse.io/domain-id": "51ed88507a244b6eb36270c0250fcc96",
               "yangtse.io/project-id": "a81f079abca74e83b47af9a586048b24",
               "yangtse.io/warm-pool-recycle-interval": "24",
               "yangtse.io/warm-pool-size": "10"
           },
           "creationTimestamp": "2024-12-10T09:12:06Z",
           "finalizers": [
               "yangtse.io/network-cleanup"
           ],
           "name": "test-namespace-default-network",
           "namespace": "a81f079abca74e83b47af9a586048b24_test-namespace",
           "resourceVersion": "25163956",
           "uid": "13000c31-2f1d-4f49-9476-569d96b75a48"
       },
       "spec": {
           "networkType": "underlay_neutron",
           "securityGroups": [
               "00c1fd2c-1b3d-4d9d-85e3-7545ef553294",
               "0161da2b-81d6-4dc3-a94d-35ec1b6c486a"
           ],
           "subnets": [
               {
                   "subnetID": "14722cef-0ebd-4906-ba3f-46a91840ac2d"
               }
           ]
       }
   }

2. Log in to the Network Console and search for the security group using the obtained security group ID.

   

3. Click the security group name and add the inbound rules shown in the following figure.
   

   If UDP is used to access the workload from the public network, a rule must be added to allow the ICMP traffic, which is generated by health checks.

   

What Do I Do If the Connection Timed Out?

Symptom

Pods can be created, but the message "[Errno 110] Connection timed out" is displayed when the Python Django SMTP service is used to send emails.

Possible cause

• Only a load balancer was purchased, and no EIPs were purchased. Therefore, containers can only be accessed from the external network. Containers can access the external network after you purchase an EIP for the workload.
• Port 25 is prohibited from sending messages to ensure that the network environment is secure.

Solutions

• Method 1: Configure an EIP for the workload. The following is an example YAML file:

  apiVersion: cci/v2
  kind: Pod
  metadata:
    labels:
      app: nginx
    name: 'nginx'
    annotations:
      yangtse.io/pod-with-eip: 'true'
  spec:
    containers:
      - image: xxxxxx
        name: container-0
        resources:
          requests:
            cpu: 500m
            memory: 1Gi

• Solution 2: Contact technical support to allow port 25 for the new EIP.

Why Is the Load of CCI Pods Higher Than That of CCE Pods?

Symptom

When the CCE Cloud Bursting Engine for CCI add-on is used to elastically schedule workloads to CCI and a Service is used to route traffic, the monitoring data shows that the load (CPU, memory, or the number of connections) of pods in CCI is significantly higher than that of pods on CCE nodes, and the traffic distribution is severely unbalanced.

Possible cause

Service Affinity of the Service retains the default option Cluster-level.

In addition to the traffic directly distributed by the load balancer associated with the Service, CCI pods also receive traffic forwarded from CCE nodes. This increases the load of CCI pods.

Solution

Change the Service Affinity of the Service to Node-level. After the modification, the CCE nodes handle only the traffic locally and do not forward the traffic to CCI across networks. The traffic is evenly distributed based on the weights in the load balancer settings.

1. Log in to the CCE console.
2. Click the name of the target CCE cluster to go to the cluster console.
3. In the navigation pane, choose Services and Ingresses.
4. Locate the target Service and choose More > Update in the Operation column.
5. On the Update Service page, set Service Affinity to Node-level.