VPC-ENI Mode Cluster Public Network Access Practice

Overview

In certain scenarios, users may need to allow nodes and pods in a CCE VPC-ENI mode cluster to access the public network. This enables external source addresses to download and install software, containers, and services through commands such as yum install.

For operations where nodes access the public network, please refer to [CCE - Public Network Access Practice](CCE/Typical Practices/CCE - Public Network Access Practice.md)

Since all pod traffic in a VPC-ENI mode cluster flows through the elastic network interfaces (ENIs) attached to nodes, we offer two solutions for configuring ENIs to enable pods in the cluster to access the public network. Users can choose the most suitable option based on their specific requirements.

Related concepts

EIP, or Elastic IP, is a service provided by Baidu AI Cloud that can be attached to CCE nodes, BLB, NAT gateways, and other services, enabling those resources to access the public network.

NAT Gateway: Baidu AI Cloud's NAT Gateway allows instances such as BCC, DCC, and others in the user VPC subnet to connect to the public network. It facilitates the translation of intranet IPs into public IPs through the NAT Gateway.

Node Subnet: When creating a CCE worker node, users can select the VPC subnet where the node resides. Generally, there are two types of subnets: general-purpose subnets and NAT-dedicated subnets. Nodes in a general-purpose subnet can directly access the public network by attaching an EIP. Conversely, nodes in a NAT-dedicated subnet can only reach the public network through a NAT Gateway.

Elastic Network Interface: Elastic network interfaces are independently created by users and attached to virtual machine instances. Users can attach ENIs during virtual machine creation, when the virtual machine is stopped, or even while it is running. After attaching and configuring ENIs, users can customize system routes to route different types of traffic through different ENIs. Pod traffic in a CCE VPC-ENI mode cluster is transmitted exclusively via the elastic network interfaces attached to the nodes.

Solution I: NAT gateway

(Note: Baidu AI Cloud's Virtual Private Cloud (VPC) no longer supports creating NAT-dedicated subnets. If you choose Solution 1 for public network access, select a general-purpose subnet as the node subnet. Existing NAT-dedicated subnets will remain unaffected and function as usual.)

A NAT Gateway can be employed to provide public network access services for a private network.

Since all container IPs originate from the secondary IPs of the elastic network interfaces, you can add a routing rule to the VPC route table as follows: Source Address: “ENI subnet”; Destination Address: “0.0.0.0/0”; Next Hop: select “NAT Gateway.”

Analyze advantages and disadvantages