Private Network Access

Overview

If you create a Service of the LoadBalancer type and configure a private network load balancer for the Service, you can use the private IP address and port of the load balancer to access the workload. This method can be used in the following scenarios: mutual access between workloads in the same namespace, mutual access between workloads and other cloud resources (such as ECSs) in the same VPC, and mutual access between workloads in different namespaces of the same VPC. Workloads are accessed over the private network through the private IP address and port of the load balancer in the format of <private-IP-address>:<port>.

Workloads run in pods. Accessing a workload is to access the pods for that workload.

Constraints

• The load balancer must be in the same VPC as the workload.
• Only dedicated load balancers can be associated with the Services.

Creating a Service for an Existing Workload

You can create a Service for a workload after it is created. Creating a Service has no impact on the workload. Once created, the Service can be used by the workload for network access immediately.

1. Log in to the CCI 2.0 console.
2. In the navigation pane, choose Services. On the right of the page, click Create from YAML.
3. Import or create a YAML file.

   The following are example files in different formats:

   • Resource description in the Service.yaml file

     apiVersion: cci/v2
     kind: Service
     metadata:
       name: kubectl-test
       namespace: kubectl
       annotations:
         kubernetes.io/elb.class: elb
         kubernetes.io/elb.id: 1234567890 # Load balancer ID. Only dedicated load balancers are supported.
     spec:
       selector:
         app: kubectl-test # Label of the associated workload
       ports:
         - name: service-0
           targetPort: 80   # Container port
           port: 12222      # Access port
           protocol: TCP     # Protocol used to access the workload
       type: LoadBalancer

   • Resource description in the Service.json file

     {
     	"apiVersion": "cci/v2",
     	"kind": "Service",
     	"metadata": {
     		"name": "kubectl-test",
     		"namespace": "kubectl",
     		"annotations": {
                             "kubernetes.io/elb.class": "elb",
     			"kubernetes.io/elb.id": "1234567890"  # Load balancer ID. Only dedicated load balancers are supported.
     		}
     	},
     	"spec": {
     		"selector": {
     			"app": "kubectl-test" # Label of the associated workload
     		},
     		"ports": [
     			{
     				"name": "service-0",
     				"targetPort": 80,     # Container port
     				"port": 12222,        # Access port
     				"protocol": "TCP",    # Protocol used to access the workload
     				"type": "LoadBalancer"
     			}
     		]
     	}
     }

4. Click OK. Access the workload through the load balancer's private IP address and port in the format of <private-IP-address>:<port>.

Updating a Service

After a Service is created, you can update its access port.

1. Log in to the CCI 2.0 console.
2. In the navigation pane, choose Services. On the Services page, select the target namespace, locate the Service, and click Edit YAML in the Operation column.
3. Only the access port can be modified.
   spec.ports[i].port indicates the access port. The port number ranges from 1 to 65535.

   

   After a Service of the LoadBalancer type is created, the listener's protocol cannot be changed (for example, the protocol cannot be changed from TCP to UDP or from HTTP to HTTPS). To change the protocol, you need to delete the Service and create another one.

4. Click OK. The Service will be updated for the workload.