Network management FAQ

Container networking FAQ

Terway-related

• What are the main network modes of Terway?

• How do I tell whether Terway is running in exclusive ENI mode or shared ENI mode?

• How do I determine whether Terway network acceleration uses DataPathv2 or IPvlan+eBPF?

• Does Terway in DataPathv2 or IPvlan+eBPF mode bypass IPVS for routing?

• Can I switch the network plug-in for an existing ACK cluster?

• After adding a virtual switch in Terway mode, my cluster cannot access the public network. What should I do?

• What should I do if IP resources in the vSwitch used by Terway run out?

• In Terway mode, pod IPs fall outside the CIDR block of the virtual switch. What should I do?

• After scaling out the vSwitch in Terway mode, pods still cannot be assigned IPs. What should I do?

• How do I enable internal load balancing for a Terway IPvlan cluster?

• How do I allowlist specific CIDR blocks for pods in Terway networks within ACK?

• What is the maximum number of pods supported in Terway network mode?

• How do I view the lifecycle of Terway network pods?

• Terway DataPath V2 dataplane mode

• Common issues when upgrading Terway components

• In Terway mode, pod creation fails with "MAC address not found"

Flannel-related

• My nodes are NotReady after upgrading my cluster to Kubernetes 1.16+. How do I fix a Flannel incompatibility?

• What's the difference between the Terway and Flannel network plugins for an ACK Kubernetes cluster?

• In a Flannel cluster, why can my Pods ping some ECS instances but not others?

• Why are newly added nodes in my Flannel cluster getting a NodeNetworkUnavailable taint?

• When do I need to configure the cloud-controller-manager (CCM) for multiple route tables in a Flannel cluster?

• Why are my Pods failing to start with the error failed to allocate for range 0: no IP addresses available in range set?

• How can I change the Pod CIDR, Service CIDR, or IPs per node for an existing ACK cluster?

kube-proxy

• What is the correct way to modify the kube-proxy configuration in an ACK cluster?

• How do I change the IPVS load balancing algorithm in kube-proxy?

• How do I reduce the UDP session timeout in kube-proxy IPVS mode to fix DNS delays?

IPv6-related

How do I troubleshoot common issues in an IPv6 dual-stack cluster?

Others

• How do I fix network latency issues immediately after a Pod starts?

• Why do my Pods get connection errors when trying to access a Service they expose themselves (hairpinning)?

• What is the correct way to plan the network for an ACK cluster?

• Does ACK support hostPort for Pods?

• How do I identify the network plugin and vSwitches used by my cluster?

• How do I view the cloud resources used by my ACK cluster?

• How can I increase the Linux connection tracking (conntrack) limit on my nodes?

• Is it possible to install a third-party CNI network plugin on an ACK cluster?

• Why do I get a no IP addresses available in range set error in my Flannel cluster?

• What should I consider when configuring a custom Cluster Domain for my ACK cluster?

Service FAQ

SLB-related

• What are the CLB instances created by an ACK cluster used for?

• How do I choose between the Local and Cluster external traffic policies?

• Why are no events displayed for Service and LoadBalancer synchronization?

• What to do if a CLB instance is stuck in the Pending state

• What to do if a vServer group is not updated

• What to do if a Service annotation does not take effect

• Why was my CLB configuration modified?

• Why is a CLB IP address inaccessible from within the cluster?

• When are CLB instances deleted?

• What to do if you accidentally delete a CLB instance

• Does deleting a Service delete the associated CLB instance?

• How do I enable CLB renaming for older CCM versions?

• How are node weights calculated in Local mode?

• How do I list all CLB instances in a cluster?

• How do I enable connection draining for a LoadBalancer Service?

CCM upgrade

• What should I do if CCM upgrade fails?

FAQ for using an existing SLB

• Why does reusing an existing CLB instance fail?

• Why are listeners not created when I reuse an existing CLB instance?

Other

• Service error messages and resolutions

• What to do if a CCM upgrade fails

• How do I enable session persistence for a Service?

• How do I configure a listener for a NodePort Service?

• How do I access a NodePort Service?

• How do I configure the NodePort range?

• How do I add required permissions for a CCM upgrade in an ACK dedicated cluster?

Ingress FAQ

Configuration

• Which SSL/TLS versions does Ingress support?

• Are L7 request headers passed through by default in Ingress?

• Can Ingress-Nginx forward traffic to backend HTTPS services?

• Does Ingress L7 pass through the client's originating IP address?

• Does Nginx Ingress Controller support HSTS?

• Which rewrite configurations does Ingress-Nginx support?

• Configure the network type for Nginx Ingress Controller

• What changes occur when upgrading the Nginx Ingress Controller component in ACK component management?

• How do I use an existing SLB with ack-ingress-nginx deployed from the marketplace?

• How do I change Ingress-nginx listeners from Layer 4 to Layer 7 (HTTPS/HTTP)?

• Nginx Ingress FAQ

Access and connectivity

• Cannot access the cluster's LoadBalancer external address from within the cluster

• Cannot access the Ingress Controller itself

• After adding or modifying a TLS certificate in the cluster, the default or old certificate is still used

• Troubleshoot Nginx Ingress anomalies

• Cannot connect to a gRPC service exposed through Ingress

• Cannot connect to a backend HTTPS service

• Source IP address is not preserved in Ingress pods

Grayscale-related

• Grayscale rules are not taking effect

• Traffic distribution doesn't match grayscale rules, or unexpected traffic enters the grayscale service

Error messages

• Error "failed calling webhook" when creating an Ingress resource

• SSL_ERROR_RX_RECORD_TOO_LONG error on HTTPS access

• Common HTTP error codes appear

• net::ERR_HTTP2_SERVER_REFUSED_STREAM error appears

• Error "The param of ServerGroupName is illegal" appears

• Error "certificate signed by unknown authority" when creating an Ingress

Other issues

• Ingress pod health checks fail, causing restarts

• Add TCP and UDP services

• Ingress rules are not taking effect

• After rewriting to the root directory, some resources fail to load or the page appears blank

• After an upgrade, SLS log parsing fails. How do I fix it?

DNS FAQ

Why can't I enter the CoreDNS pod using exec?

Why is CoreDNS using a deprecated API?

CoreDNS logs show "dns: buffer size too small"

Network fundamentals

How do I access workloads over the public network?

How do pods in an ACK cluster obtain the client's originating IP address?

• If you are not using WAF and your cluster exposes services via SLB, check the Service YAML file to ensure that externalTrafficPolicy is set to Local mode, which lets you obtain the originating IP address of the client. If your cluster exposes services via Ingress, check the nginx-ingress-lb's externalTrafficPolicy and ensure that externalTrafficPolicy is set to Local mode.

• If you are using WAF, see Use WAF.

How do I implement throttling protection for traffic in an ACK cluster?

To precisely control traffic in your ACK cluster—or if you face high network loads, service overload, resource shortages, or network attacks—use service mesh (ASM) to enforce traffic limiting. This protects backend service stability, reduces costs, and improves end-user experience. See Throttling protection.