Access external networks from a pod
Pods in an ACS cluster can reach resources in Virtual Private Clouds (VPCs)—including ECS instances, ApsaraDB RDS instances, OSS buckets, and SLB instances—as well as the Internet. Outbound connectivity depends on two sides: the pod (source) and the destination. Configure both sides to allow a pod to access an external network.
Configure the source (pod side)
When a pod sends traffic to an external address, the request goes through the cluster's DNS resolver, is subject to any network policies on the pod's namespace, and is checked against the security groups attached to the pod and cluster. Verify all three before investigating the destination.
DNS resolution
Pods use the cluster's built-in Domain Name System (DNS) resolver to translate a destination hostname into an IP address. If DNS resolution fails, troubleshoot the DNS resolution error.
Network policy
Check whether a network policy is applied to the namespace where the pod runs, and whether that policy blocks outbound traffic to the destination IP address. If a blocking policy exists, modify it to allow the required traffic. For more information, see Use network policies in ACS clusters.
Security groups
Check the security groups attached to both the cluster and the pod. For outbound traffic to succeed, the security group rules must meet both of the following conditions:
-
An outbound rule allows the pod to reach the destination IP address and port.
-
No outbound rule explicitly denies access to the destination IP address and port.
Configure the destination
The configuration required at the destination varies depending on what the pod is trying to reach.
Access the Internet
Two methods are available for pod Internet access.
| Method | When to use | Public IP address | Reference |
|---|---|---|---|
| Use an Internet NAT gateway | Multiple pods | The Elastic IP Address (EIP) associated with the Internet NAT gateway | Enable Internet access for an ACS cluster |
| Associate an EIP with the pod | A single pod | The EIP associated with the pod | Mount an independent EIP for pods |
Outbound public IP address and SNAT rules
When you need to add ACS cluster outbound addresses to a third-party IP allowlist (for example, on Alipay Open Platform or another external service), the public IP address that your pods use is determined by your Internet access method:
-
Internet NAT gateway: The outbound IP address is the Elastic IP Address (EIP) bound to the Internet NAT gateway in the same VPC as your ACS cluster. To find this address, go to your NAT gateway in the VPC console and check the EIP listed under the gateway details.
-
Pod-bound EIP: The outbound IP address is the EIP directly bound to the pod.
Enabling an Internet NAT gateway and binding an EIP take effect immediately. However, pods cannot access the Internet until you also configure a Source Network Address Translation (SNAT) rule that covers the ACS cluster subnet. Without an SNAT rule, outbound traffic from pods is dropped even if the NAT gateway and EIP are active. To verify that an SNAT rule exists, go to the NAT gateway details page in the VPC console and check the SNAT Entries list.
Access cloud resources in the same VPC
Destination resources such as ECS instances, ApsaraDB RDS instances, and OSS buckets may have access control rules—security groups, network Access Control Lists (ACLs), or whitelists—that block traffic from pod IP addresses. If a pod cannot reach a resource in the cluster VPC, check the access control configuration on the destination resource and add a rule to allow inbound traffic from the pod's IP address.
Access a LoadBalancer Service
Traffic originating inside a cluster cannot reach the cluster's own LoadBalancer Services, regardless of whether the Service uses a public or private address. To resolve this, modify the external traffic policy of the target Service. For more information, see What can I do if the cluster cannot access the IP address of the SLB instance exposed by the LoadBalancer Service.
FAQ
Does ACS Serverless support retrieving metadata through the Alibaba Cloud instance metadata service?
The Alibaba Cloud instance metadata service (accessible at 100.100.100.200) is typically used on ECS instances to retrieve instance information such as the instance ID, VPC ID, and underlying VM ID. In the ACS serverless architecture, the instance metadata service is not supported by default. Do not rely on the instance metadata service to retrieve instance information from ACS Serverless workloads. Instead, use the Kubernetes API or Alibaba Cloud OpenAPI to obtain the required information.
How do I test external network connectivity when the pod image does not include curl?
When a pod image does not include network debugging tools such as curl, create a temporary debugging pod using a purpose-built image. For example, use the nicolaka/netshoot image:
kubectl run debug-pod --image=nicolaka/netshoot --rm -it -- bashFrom the debug pod, run connectivity tests such as curl -I https://example.com. Delete the pod when you are finished. This approach avoids modifying production images and keeps the debugging environment isolated. Because the temporary pod runs in the same cluster network environment as your workload pods and is subject to the same network policies and security group rules, its results accurately reflect the actual outbound connectivity of your pods.
Alternatively, use the lightweight curlimages/curl image:
kubectl run curl-test --image=curlimages/curl --rm -it -- sh