How ACK’s Hybrid Nodes Gateway Enables Seamless IDC‑VPC Pod Networking

1. Background – Hybrid Cloud Container Networking

Enterprises that add IDC servers to an Alibaba Cloud ACK cluster face the problem of making pods on IDC nodes reachable from the VPC. The ACK CNI Terway Hybrid offers Underlay and Overlay modes, but in Overlay mode the central VPC cannot recognize the container CIDR, preventing pod‑to‑pod communication.

2. Product – A Component to Connect Cloud and IDC Pods

The ack‑hybrid‑nodes‑gateway is a VXLAN gateway component designed for the Overlay scenario. It enables bidirectional routing of pod IPs between the cloud VPC and the IDC without requiring BGP configuration on IDC switches or any physical network redesign.

No IDC network modification : No BGP or static routes on IDC switches; traffic is carried as UDP‑encapsulated VXLAN packets over a dedicated link.

Out‑of‑the‑box and automated : A single installation automatically discovers hybrid nodes, updates routing, ARP and FDB tables, and adapts to node scaling without manual intervention.

High availability : Deployed with two replicas; Kubernetes Lease performs leader election and both replicas maintain full data‑plane state, enabling second‑level failover.

3. Typical Use Cases

Control‑plane webhook access : The Kubernetes API server can reach admission‑controller webhooks (e.g., cert‑manager, OPA/Gatekeeper, Kyverno) running on IDC nodes.

Cross‑environment pod communication : Pods on cloud ECS nodes can directly talk to pods on IDC nodes, useful for stateless services combined with GPU inference workloads.

Cloud product integration : Alibaba Cloud NLB, Prometheus, ARMS, etc., can monitor and load‑balance pods residing in the IDC.

External traffic to GPU workloads : ALB/NLB can forward external requests directly to GPU pods in the IDC without an additional ingress layer.

4. Working Principle

The gateway is deployed as a Deployment on a few dedicated ECS “gateway nodes” inside the VPC. Its operation consists of three parts:

Automatic VXLAN tunnel construction : The component watches the custom resource TerwayHybridNode. When a hybrid node joins, changes, or leaves, the gateway updates routes, ARP, and FDB entries and creates a VXLAN tunnel to that node.

Traffic encapsulation and forwarding : Traffic from a cloud pod destined for an IDC overlay pod is first routed to the gateway ECS node, encapsulated in VXLAN, sent over the dedicated line, then decapsulated by the IDC node and delivered to the target pod.

Dual‑replica HA with fast failover : Two replicas run with leader election via Kubernetes Lease; both maintain complete VXLAN data‑plane state, allowing rapid switchover if the leader fails.

The gateway supports two return‑path modes for cloud‑initiated connections: asymmetric (default, return traffic goes directly over the line) and symmetric (return traffic also traverses VXLAN), selectable based on security‑group rules and performance needs.

5. Getting Started

The component works with ACK managed clusters version 1.33 or later, where the terway‑hybrid overlay network is enabled and the terway‑hybrid‑controlplane and terway‑hybrid plugins are installed. Deployment requires only two ECS instances as gateway nodes, opening a VXLAN port, and a one‑click installation of the component. Detailed steps are provided in the official ACK documentation.

Conclusion

Network connectivity is the key to realizing hybrid‑cloud node pools. The ack‑hybrid‑nodes‑gateway provides a lightweight, automated, and highly available overlay gateway that bridges the central VPC with on‑premise IDC pods, dramatically lowering the barrier to hybrid‑cloud container networking.