<p>I have a Kubernetes cluster running in Amazon EC2 inside its own VPC, and I'm trying to get Dockerized services to connect to an RDS database (which is in a different VPC). I've figured out the peering and routing table entries so I can do this from the minion machines:</p>

<pre><code>ubuntu@minion1:~$ psql -h &lt;rds-instance-name&gt;
Password:
</code></pre>

<p>So that's all working. The problem is that when I try to make that connection from inside a Kubernetes-managed container, I get a timeout:</p>

<pre><code>ubuntu@pod-1234:~$ psql -h &lt;rds-instance-name&gt;
…
</code></pre>

<p>To get the minion to connect, I configured a peering connection, set up the routing tables from the Kubernetes VPC so that <code>10.0.0.0/16</code> (the CIDR for the RDS VPC) maps to the peering connection, and updated the RDS instance's security group to allow traffic to port 5432 from the address range <code>172.20.0.0/16</code> (the CIDR for the Kubernetes VPC).</p>

<p>With the help of Kelsey Hightower, I solved the problem. It turns out it was a Docker routing issue. I've written up the details in a <a href="http://ben.straub.cc/2015/08/19/kubernetes-aws-vpc-peering/" rel="noreferrer">blog post</a>, but the bottom line is to alter the minions' routing table like so:</p>

<pre><code>$ sudo iptables -t nat -I POSTROUTING -d &lt;RDS-IP-ADDRESS&gt;/32 -o eth0 -j MASQUERADE
</code></pre>
