Network management FAQ
Find answers to container networking, Service, Ingress, and DNS questions for ACK clusters.
Index
Container networking FAQ
Terway-related
How do I tell whether Terway is running in exclusive ENI mode or shared ENI mode?
How do I determine whether Terway network acceleration uses DataPathv2 or IPvlan+eBPF?
Does Terway in DataPathv2 or IPvlan+eBPF mode bypass IPVS for routing?
Can I switch the network plug-in for an existing ACK cluster?
What should I do if IP resources in the vSwitch used by Terway run out?
In Terway mode, pod IPs fall outside the CIDR block of the virtual switch. What should I do?
After scaling out the vSwitch in Terway mode, pods still cannot be assigned IPs. What should I do?
How do I enable internal load balancing for a Terway IPvlan cluster?
How do I allowlist specific CIDR blocks for pods in Terway networks within ACK?
What is the maximum number of pods supported in Terway network mode?
In Terway mode, pod creation fails with "MAC address not found"
Flannel-related
What's the difference between the Terway and Flannel network plugins for an ACK Kubernetes cluster?
In a Flannel cluster, why can my Pods ping some ECS instances but not others?
Why are newly added nodes in my Flannel cluster getting a NodeNetworkUnavailable taint?
How can I change the Pod CIDR, Service CIDR, or IPs per node for an existing ACK cluster?
kube-proxy
What is the correct way to modify the kube-proxy configuration in an ACK cluster?
How do I change the IPVS load balancing algorithm in kube-proxy?
How do I reduce the UDP session timeout in kube-proxy IPVS mode to fix DNS delays?
IPv6-related
How do I troubleshoot common issues in an IPv6 dual-stack cluster?
Other issues
How do I fix network latency issues immediately after a Pod starts?
What is the correct way to plan the network for an ACK cluster?
How do I identify the network plugin and vSwitches used by my cluster?
How can I increase the Linux connection tracking (conntrack) limit on my nodes?
Is it possible to install a third-party CNI network plugin on an ACK cluster?
Why do I get a no IP addresses available in range set error in my Flannel cluster?
What should I consider when configuring a custom Cluster Domain for my ACK cluster?
Service FAQ
CLB configuration
Question | Summary |
Two CLB instances: API server and Nginx Ingress Controller | |
How do I choose between the Local and Cluster external traffic policies? | Comparison of traffic policy behaviors |
CCM overwrites manual CLB console changes | |
Weight formulas by CCM version | |
How do I enable connection draining for a LoadBalancer Service? | Annotations for connection draining |
kubectl + jq command to list all LoadBalancer Services | |
Manually tagging CLB instances created by CCM v1.9.3.10 or earlier |
CLB access and lifecycle
Question | Summary |
Why is a CLB IP address inaccessible from within the cluster? | Layer 4 limitations and Local mode behavior |
Deletion policies for CCM-created vs. reused CLB instances | |
Recovery steps for API server, Ingress, and application CLB instances |
Reusing an existing CLB instance
Question | Summary |
CCM version, instance origin, and VPC requirements | |
Why are listeners not created when I reuse an existing CLB instance? | Force-override annotation required |
CLB troubleshooting
Question | Summary |
Check events and resolve errors | |
Check events and resolve errors | |
CCM version, annotation presence, and syntax | |
Why are no events displayed for Service and LoadBalancer synchronization? | CCM version earlier than v1.9.3.276-g372aa98-aliyun |
Service error messages
Question | Summary |
Backend server quota, vSwitch IP exhaustion, node availability | |
ENI mode, target port, resource group, address type, billing method | |
VPC mismatch, API throttling, vServer group conflicts | |
Reusing CCM-created CLB, CLB not found, CLB reattachment | |
Overdue payment, insufficient balance, shared instance discontinued |
NodePort and CCM
Question | Summary |
Access methods by network scope | |
Change to LoadBalancer type | |
ServiceNodePortRange and port conflict avoidance | |
Troubleshooting link | |
How do I add permissions required for a CCM upgrade in an ACK dedicated cluster? | RAM permissions for v2.11.2 and later |
Ingress FAQ
Configuration
Are L7 request headers passed through by default in Ingress?
Can Ingress-Nginx forward traffic to backend HTTPS services?
Does Ingress L7 pass through the client's originating IP address?
How do I use an existing SLB with ack-ingress-nginx deployed from the marketplace?
How do I change Ingress-nginx listeners from Layer 4 to Layer 7 (HTTPS/HTTP)?
Access and connectivity
Canary release
Error messages
Error "failed calling webhook" when creating an Ingress resource
Error "certificate signed by unknown authority" when creating an Ingress
Other issues
DNS FAQ
Why can't I enter the CoreDNS pod using exec?
Network fundamentals
How do I access workloads over the public network?
ACK supports five public network access methods:
How do pods in an ACK cluster obtain the client's originating IP address?
Without WAF, set
externalTrafficPolicytoLocalin the Service YAML (for SLB-exposed services) to preserve the client source IP. For Ingress, check the nginx-ingress-lbexternalTrafficPolicyand setexternalTrafficPolicytoLocal.If using WAF, see Use WAF.
How do I implement throttling protection for traffic in an ACK cluster?
To precisely control traffic in ACK clusters, or to handle high network loads, service overload, resource shortages, or network attacks, use Service Mesh (ASM) for rate limiting. This protects backend service stability, reduces costs, and improves the end-user experience. See Throttling protection.