Accessing the Internet from a Pod

How to Implement

The method of accessing a public network address from a pod varies depending on the network model of the cluster. For details, see Table 1.

A CCE Turbo cluster is used as an example to describe how to use a NAT gateway to access the Internet. The NAT gateway allows pods in a VPC to access the Internet through SNAT. SNAT translates private IP addresses to public IP addresses using the assigned EIP. This allows pods in the VPC to share the EIP for Internet access. For details, see Figure 1. SNAT allows pods in a VPC to access the Internet directly, even without an EIP. However, they cannot receive traffic from the Internet. The NAT gateway efficiently supports high-concurrency connections and enables Internet access. It is well-suited for scenarios with a large volume of requests and connections.

Figure 1 How an SNAT rule works

Prerequisites

• A CCE cluster is available. For details, see Buying a CCE Standard/Turbo Cluster.
• A pod is available in the cluster. For details, see Creating a Deployment.

Procedure

To enable a pod to access the Internet, perform the following operations:

1. Check the pod CIDR block.
   1. Log in to the management console.
   2. Click in the upper left corner and choose Containers > Cloud Container Engine.
   3. Click the cluster name to access the cluster console. In the navigation pane, choose Overview. In the Networking Configuration area, view the pod subnet.
      Figure 2 Viewing a pod subnet
      

2. Check the access from the pod to the Internet. Log in to the pod and run the following command on CloudShell:

   curl -I console-intl.huaweicloud.com

   If information similar to the following is displayed, the pod cannot access the Internet:

   curl: (7) Failed to connect to console-intl.huaweicloud.com port 80: Connection timed out

3. Assign an EIP. For details, see Assigning an EIP.
   1. Click in the upper left corner of the console and select a region.
      

      Set Region to the one where the target pod is located.

   2. Click in the upper left corner and choose Service List > Networking > Elastic IP.
   3. On the EIPs page, click Buy EIP.
   4. Configure the parameters following instructions. For details, see Figure 3.
      Figure 3 Buying an EIP
      

4. Buy a NAT gateway. For details, see Buy a Public NAT Gateway.
   1. Click in the upper left corner and choose Networking > NAT Gateway.
   2. On the displayed page, click Buy Public NAT Gateway.
   3. Configure parameters as instructed. Set VPC to the same one as the cluster and Subnet to the pod subnet. For details, see Figure 4. When using a CCE Turbo cluster, set Subnet to the one where the pod is located. When using a CCE standard cluster, set Subnet to the one where the node is located.
      Figure 4 Buying a NAT gateway
      

5. Configure an SNAT rule and bind the EIP to the subnet. For details, see Add an SNAT Rule.
   1. On the page displayed, click the name of the NAT gateway for which you want to add the SNAT rule.
   2. On the SNAT Rules tab, click Add SNAT Rule.
   3. Configure parameters as instructed. For details, see Figure 5.
      

      SNAT rules take effect by CIDR block. When configuring CIDR blocks for different container network models, consider their communication modes. Follow these rules to ensure proper configuration:

      • For a CCE standard cluster using a tunnel or VPC network, select the CIDR block where the node is located, which is the CIDR block selected during node creation.
      • For a CCE Turbo cluster using a Cloud Native 2.0 network, select the pod CIDR block used during cluster creation.

      If there are multiple CIDR blocks, you can create multiple SNAT rules or customize a CIDR block. Make sure that the selected CIDR block includes either the container subnet (for the Cloud Native 2.0 network) or the node subnet (for the tunnel network and VPC network).

      Figure 5 Adding an SNAT rule
      

6. Check whether the pod can access the Internet. Log in to the pod and run the following command on CloudShell:

   curl -I console-intl.huaweicloud.com

   If information similar to the following is displayed, the pod can access the Internet:

   HTTP/1.1 301 Moved Permanently
   Server: CloudWAF
   Date: Mon, 19 Aug 2024 12:43:20 GMT
   Content-Type: text/html
   Connection: keep-alive
   Set-Cookie: HWWAFSESID=b4119798a9b29b3c77; path=/
   Set-Cookie: HWWAFSESTIME=1724071396374; path=/
   ...