[tke] whether to configure SNAT when the container accesses services outside the node

Applicable scenarios

stay TKE Whether it's Global Router still VPC-CNI Network mode , Access the cluster in the container VPC By default, the network segment and container network segment do not SNAT Of , But in addition, you can access other network segments SNAT Of , In some business scenarios, the container source needs to be preserved IP when , We need to modify the relevant configuration to avoid accessing some IP Or network segment SNAT, Thus, the container source is preserved IP The needs of .

Operation steps

When available kubectl Connected to a clustered environment , Execute the following command in the resource "NonMasqueradeCIDRs" Add don't want to do... To the field list SNAT The purpose of the visit IP Or network segment . Corresponding , If you want to access a specific network segment SNAT, Delete a specific network segment from the list ：

kubectl edit cm  ip-masq-agent-config -n kube-system

The modification description is shown in the following figure （ Be careful YAML Format ）：

The operation sample

wait for "ResyncInterval" cycle time （ Default 1 minute ） Post test to see if the configuration is effective .