Accessing the Internet from a Pod

How to Implement

The method of accessing a public network address from a pod varies depending on the network model of the cluster. For details, see Table 1.

The following uses a CCE Turbo cluster as an example to describe how to use a NAT gateway to access the Internet. The NAT gateway allows containers in a VPC to access the Internet through source network address translation (SNAT), which translates containers' private IP addresses to public IP addresses using the assigned EIP. This allows the containers to use the shared EIP to access the Internet. For details, see Figure 1. SNAT allows containers in a VPC to access the Internet directly, even without an EIP. However, they cannot receive traffic from the Internet. The NAT gateway provides efficient support for high-concurrency connections and enables public network access. It is well-suited for scenarios with a large volume of requests and connections.

Figure 1 How an SNAT rule works

Prerequisites

• A CCE cluster is available. For details, see Buying a CCE Standard/Turbo Cluster.
• A pod is available in the cluster. For details, see Creating a Deployment.

Procedure

To enable a pod to access the Internet, perform the following steps:

1. Check the pod CIDR block.
   1. Log in to the management console.
   2. Click in the upper left corner and choose Containers > Cloud Container Engine.
   3. Click the cluster name to access the cluster console. In the navigation pane, choose Overview. In the Networking Configuration area, check the pod subnet.
      Figure 2 Pod subnet
      

2. Check the access from the pod to the Internet. Log in to the target pod and run the following command on the CloudShell page:

   curl -I console-intl.huaweicloud.com

   If information similar to the following is displayed, the pod cannot access the Internet:

   curl: (7) Failed to connect to console-intl.huaweicloud.com port 80: Connection timed out

3. Assign an EIP. For details, see Assigning an EIP.
   1. Click in the upper left corner of the console and select a region.
      

      Set Region to the one where the target pod is located.

   2. Click in the upper left corner and choose Networking > Elastic IP.
   3. On the EIPs page, click Buy EIP.
   4. Configure parameters as prompted. For details, see Figure 3.
      Figure 3 Buying an EIP
      

4. Buy a NAT gateway. For details, see Buy a Public NAT Gateway.
   1. Click in the upper left corner and choose Networking > NAT Gateway.
   2. On the displayed page, click Buy Public NAT Gateway.
   3. Configure parameters as prompted. Set VPC to the one used by the cluster and Subnet to the pod subnet. For details, see Figure 4. When using a CCE Turbo cluster, set Subnet to the one where the pod is located. When using a CCE standard cluster, set Subnet to the one where the node is located.
      Figure 4 Buying a NAT gateway
      

5. Configure an SNAT rule and bind the EIP to the subnet. For details, see Add an SNAT Rule.
   1. On the page displayed, click the name of the NAT gateway for which you want to add the SNAT rule.
   2. On the SNAT Rules tab page, click Add SNAT Rule.
   3. Configure parameters as prompted. For details, see Figure 5.
      

      SNAT rules take effect by CIDR block. When configuring CIDR blocks for different container network models, consider their communication modes. Follow these rules to ensure proper configuration:

      • For a CCE standard cluster using a tunnel or VPC network, select the CIDR block where the node is located, which is the block selected during node creation.
      • For a CCE Turbo cluster using Cloud Native Network 2.0, select the container CIDR block used during cluster creation.

      If there are multiple CIDR blocks, you can create multiple SNAT rules or customize a CIDR block. Make sure that the selected CIDR block includes either the container subnet (for Cloud Native Network 2.0) or the node subnet (for tunnel network and VPC network).

      Figure 5 Adding an SNAT rule
      

6. Check whether the pod can access the Internet. Log in to the target pod and run the following command on the CloudShell page:

   curl -I console-intl.huaweicloud.com

   If information similar to the following is displayed, the pod can access the Internet:

   HTTP/1.1 301 Moved Permanently
   Server: CloudWAF
   Date: Mon, 19 Aug 2024 12:43:20 GMT
   Content-Type: text/html
   Connection: keep-alive
   Set-Cookie: HWWAFSESID=b4119798a9b29b3c77; path=/
   Set-Cookie: HWWAFSESTIME=1724071396374; path=/
   ...