Enabling Cross-VPC Network Communications Between CCE Clusters
Application Scenarios
Because services in different VPCs cannot communicate with each other, CCE clusters are unable to communicate across VPCs. To resolve this, a VPC peering connection can be established between two VPCs with different CIDR blocks. This allows clusters in a VPC to access clusters or other services in another VPC.

To enable cross-VPC access, allow clusters that use different networks to communicate.
- CCE standard clusters using the tunnel networks or CCE Turbo clusters using the Cloud Native 2.0 networks: You only need to enable communication between the VPC CIDR blocks at both ends.
- Clusters using the VPC networks: You need to enable communication between the VPC CIDR blocks and container CIDR blocks at both ends. This is due to the features of such clusters. Clients in the same VPC as a cluster can directly access pods in the cluster through the pod IP addresses. For details, see Cross-VPC Cluster Connection.
For example, if the local VPC CIDR block is 172.16.0.0/16 and the peer VPC CIDR block is 172.17.0.0/16, the route tables at both ends should be configured as shown in the table below.
Cluster Network | VPC Route Tables at Both Ends | |
|---|---|---|
Local VPC Route Table | Peer VPC Route Table | |
Tunnel network | The peer VPC CIDR block (172.17.0.0/16) must be added to the destination IP address. | The cluster VPC CIDR block (172.16.0.0/16) must be added to the destination IP address. |
VPC network | The peer VPC CIDR block (172.17.0.0/16) must be added to the destination IP address. The container CIDR block of the cluster, for example, 10.0.0.0/16, must be added to the destination IP address. | The cluster VPC CIDR block (172.16.0.0/16) must be added to the destination IP address. The container CIDR block of the cluster, for example, 10.0.0.0/16, must be added to the destination IP address. |
Cloud Native 2.0 network (for CCE Turbo clusters) | The peer VPC CIDR block (172.17.0.0/16) must be added to the destination IP address. | The cluster VPC CIDR block (172.16.0.0/16) must be added to the destination IP address. |
Step 1: Create a VPC Peering Connection
- Log in to the VPC console. In the navigation pane, choose VPC Peering Connections.
- In the upper right corner of the page, click Create VPC Peering Connection.
- Configure the parameters as instructed. For details about the parameters, see Table 1.Figure 2 Creating a VPC peering connection

Table 1 Parameters for creating a VPC peering connection Parameter
Description
Example Value
VPC Peering Connection Name
Mandatory.
Enter a name for the VPC peering connection.
The name can contain a maximum of 64 characters, including letters, digits, hyphens (-), and underscores (_).
peering-AB
Local VPC
Mandatory.
VPC at one end of the VPC peering connection. You can select one from the drop-down list.
vpc-A
Local VPC CIDR Block
CIDR block of the selected local VPC
vpc-A CIDR block: 172.16.0.0/16
Account
Mandatory.
- My account: The local and peer VPCs are from the same account.
- Another account: The local and peer VPCs are from different accounts.
Current account
Peer Project
The system fills in the corresponding project by default because Account is set to My account.
For example, if vpc-A and vpc-B are in account A and region A, the system fills in the correspond project of account A in region A by default.
None
Peer VPC
Mandatory if Account is set to My account.
VPC at the other end of the VPC peering connection. You can select one from the drop-down list.
vpc-B
Peer VPC CIDR Block
CIDR block of the selected peer VPC
If the local and peer VPCs have overlapping CIDR blocks, the VPC peering connection may not take effect.
vpc-B CIDR block: 172.17.0.0/16
Description
Optional.
Enter the description of the VPC peering connection in the text box as required.
Use peering-AB to connect vpc-A and vpc-B.
- After configuring the parameters, click Create Now. The dialog box for adding a route is displayed.
- In the displayed dialog box, click Add Now. On the displayed page about the VPC peering connection details, go to For Clusters Using the Tunnel or Cloud Native 2.0 Networks to add a route.
Step 2: Add Routes for the VPC Peering Connection
As shown in the route configurations for clusters using different networks, the CIDR blocks that must be enabled vary across clusters which use different networks.
Assume that the local VPC CIDR block is 172.16.0.0/16 and the peer VPC CIDR block is 172.17.0.0/16. To configure a route table, take the following steps:
- In the lower part of the VPC peer connection details page, click Add Route. The Add Route dialog box is displayed.Figure 3 Adding routes for the VPC peering connection

- Add routes to the VPC CIDR blocks at both ends in the route tables as instructed. Table 2 describes the parameters.
Table 2 Adding routes to both VPC CIDR blocks Parameter
Description
Example Value
VPC
Select a VPC that is connected by the VPC peering connection.
vpc-A
Route Table
Select the route table of the VPC. The route will be added to this route table.
Each VPC comes with a default route table to control the outbound traffic from the subnets in the VPC. In addition to the default route table, you can create a custom route table and associate it with the subnets in the VPC. Then, the custom route table controls outbound traffic of the subnets.- If there is only the default route table in the drop-down list, select the default route table.
- If there are both default and custom route tables in drop-down list, select the route table associated with the subnet connected by the VPC peering connection.
rtb-vpc-A (Default route table)
Destination
IP address in the VPC at the other end of the VPC peering connection. The value can be a VPC CIDR block, subnet CIDR block, or ECS IP address.
vpc-B CIDR block: 172.17.0.0/16
Next Hop
The default value is the current VPC peering connection. You do not need to specify this parameter.
peering-AB
Description
Supplementary information about the route. This parameter is optional.
The route description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
Route from vpc-A to vpc-B
Add a route for the other VPC
If you select this option, you can also add a return route for the other VPC of the VPC peering connection.
To allow VPCs connected through VPC peering to communicate, you must include forward and return routes in the VPCs' route tables.
Select this option.
VPC
By default, the system selects the other VPC connected by the VPC peering connection. You do not need to specify this parameter.
vpc-B
Route Table
Select the route table of the VPC that the route will be added to.
Each VPC comes with a default route table to control the outbound traffic from the subnets in the VPC. In addition to the default route table, you can also create a custom route table and associate it with the subnets in the VPC. Then, the custom route table controls outbound traffic of the subnets.- If there is only the default route table in the drop-down list, select the default route table.
- If there are both default and custom route tables in drop-down list, select the route table associated with the subnet connected by the VPC peering connection.
rtb-vpc-B (Default route table)
Destination
IP address in the VPC at the other end of the VPC peering connection. The value can be a VPC CIDR block, subnet CIDR block, or ECS IP address.
vpc-A CIDR block: 172.16.0.0/16
Next Hop
The default value is the current VPC peering connection. You do not need to specify this parameter.
peering-AB
Description
Supplementary information about the route. This parameter is optional.
The route description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
Return route from vpc-B to vpc-A.
- After configuring the routes, click OK and go back to the route list. You can view the added routes.
Assume that the local VPC CIDR block is 172.16.0.0/16, the peer VPC CIDR block is 172.17.0.0/16, and the container CIDR block of the cluster is 10.0.0.0/16. To configure a route table, take the following steps:
- In the lower part of the VPC peer connection details page, click Add Route. The Add Route dialog box is displayed.Figure 4 Adding routes for the VPC peering connection

- Add routes to the VPC CIDR blocks at both ends in the route tables as instructed. Table 3 describes the parameters.
Table 3 Adding routes to both VPC CIDR blocks Parameter
Description
Example Value
VPC
Select a VPC that is connected by the VPC peering connection.
vpc-A
Route Table
Select the route table of the VPC. The route will be added to this route table.
Each VPC comes with a default route table to control the outbound traffic from the subnets in the VPC. In addition to the default route table, you can create a custom route table and associate it with the subnets in the VPC. Then, the custom route table controls outbound traffic of the subnets.- If there is only the default route table in the drop-down list, select the default route table.
- If there are both default and custom route tables in drop-down list, select the route table associated with the subnet connected by the VPC peering connection.
rtb-vpc-A (Default route table)
Destination
IP address in the VPC at the other end of the VPC peering connection. The value can be a VPC CIDR block, subnet CIDR block, or ECS IP address.
vpc-B CIDR block: 172.17.0.0/16
Next Hop
The default value is the current VPC peering connection. You do not need to specify this parameter.
peering-AB
Description
Supplementary information about the route. This parameter is optional.
The route description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
Route from vpc-A to vpc-B
Add a route for the other VPC
If you select this option, you can also add a return route for the other VPC of the VPC peering connection.
To allow VPCs connected through VPC peering to communicate, you must include forward and return routes in the VPCs' route tables.
Select this option.
VPC
By default, the system selects the other VPC connected by the VPC peering connection. You do not need to specify this parameter.
vpc-B
Route Table
Select the route table of the VPC that the route will be added to.
Each VPC comes with a default route table to control the outbound traffic from the subnets in the VPC. In addition to the default route table, you can also create a custom route table and associate it with the subnets in the VPC. Then, the custom route table controls outbound traffic of the subnets.- If there is only the default route table in the drop-down list, select the default route table.
- If there are both default and custom route tables in drop-down list, select the route table associated with the subnet connected by the VPC peering connection.
rtb-vpc-B (Default route table)
Destination
IP address in the VPC at the other end of the VPC peering connection. The value can be a VPC CIDR block, subnet CIDR block, or ECS IP address.
vpc-A CIDR block: 172.16.0.0/16
Next Hop
The default value is the current VPC peering connection. You do not need to specify this parameter.
peering-AB
Description
Supplementary information about the route. This parameter is optional.
The route description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).
Return route from vpc-B to vpc-A.
- After configuring the routes, click OK and go back to the route list. You can view the added routes.
- Click Add Route and add the route of the container CIDR block of the cluster to the VPC route tables by referring to Table 4.Figure 5 Adding routes of the container CIDR block of a cluster

Table 4 Configuring route parameters Parameter
Example Value
VPC
vpc-A
Route Table
rtb-vpc-A (Default route table)
Destination
In this example, the container CIDR block of the cluster is 10.0.0.0/16.
Next Hop
peering-AB
Description
Route from vpc-A to vpc-B
Add a route for the other VPC
Select this option.
VPC
vpc-B
Route Table
rtb-vpc-B (Default route table)
Destination
In this example, the container CIDR block of the cluster is 10.0.0.0/16.
Next Hop
peering-AB
Description
Return route from vpc-B to vpc-A.
- Click OK.
Follow-Up Operations
If a cluster needs to access services in other VPCs, it is important to verify if those cloud services permit access outside their VPCs. This may involve adding a trustlist or security group to enable access to certain services. In the case of a cluster using a VPC network, you must allow the container CIDR block to access the destination ends.
For example, if a cluster using the VPC network model needs to access an ECS in a different VPC, you must allow the cluster VPC CIDR block and its container CIDR block to pass through the ECS security group. This ensures that nodes and containers in the cluster can access the ECS.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
