FAQ about cloud-native gateways - Microservices Engine - Alibaba Cloud Documentation Center

This topic provides answers to some frequently asked questions about cloud-native gateways of Microservices Engine (MSE).

Do MSE cloud-native gateways support IPv6?

Yes, MSE cloud-native gateways support IPv6. A Classic Load Balancer (CLB) or Network Load Balancer (NLB) instance can be used as the traffic ingress of an MSE cloud-native gateway. You only need to associate an IPv6-enabled CLB or NLB instance with the gateway on the Gateway Ingress tab of the Overview page.

Do cloud-native gateways support the X-Real-IP request header?

By default, cloud-native gateways do not support the X-Real-IP request header. X-Real-IP is an exclusive request header in NGINX Ingress gateways. You must use the http-real-ip plug-in provided by NGINX Ingress gateways to extract the client IP address based on the configuration and write the client IP address to the X-Real-IP request header.

Do cloud-native gateways support the X-Forwarded-For request header?

Yes, cloud-native gateways support the X-Forwarded-For request header. If the original request carries the X-Forwarded-For header, the gateway appends the previous-hop IP address of the gateway to the request header. If the original request does not carry the X-Forwarded-For header, the gateway adds the header to the request and writes the previous-hop IP address of the gateway to the request header.

Note

By default, the built-in Tomcat of Spring Boot deletes the last address in the X-Forwarded-For header. You can add the server.forward-headers-strategy=none configuration to Spring Boot to prevent the deletion operation.

What do I do if the "upstream connect error or disconnect/reset header" message appears when the cloud-native gateway forwards a request?

The issue occurs because the security group of the backend service does not allow the gateway to access the service port. On the Overview page of the gateway, click the Security Group Authorization tab, and click Add Security Group Rule to add a security group rule. After the security group rule is added, the gateway can directly forward the request to the pod IP address of the Container Service for Kubernetes (ACK) cluster. You must specify the port used by the pod in the security group rule.

How do I use headers to match domain names in the cloud-native gateway?

Add a rule for matching request headers when you create a route. Specify :authority as the header name and set the header value to a specific domain name.

What do I do if I am unable to view the plug-in logs of the cloud-native gateway?

The issue may be caused by the following reasons:

The logs are not printed because the current log level is Trace or Debug. By default, the plug-in prints only logs of the Info level or a higher level.
The plug-in does not start as expected due to a compilation issue. In this case, clear the default log query statement and query the error logs that are generated during the startup of the plug-in. Correctly compile the plug-in code by following instructions in the plug-in development document, and debug the plug-in by using Docker Compose on your on-premises machine to ensure that the plug-in is valid. Then, upload the plug-in to the cloud-native gateway.

What do I do if an error is reported when the request body size exceeds the upper limit of the cloud-native gateway?

This issue occurs because the size of the gateway connection buffer is too small. Increase the buffer size based on the protocol type.

If HTTP 1.x is used, increase the value of the DownstreamConnectionBufferLimits parameter in the MSE console.
If HTTP/2 is used, increase the values of the DownstreamConnectionBufferLimits and InitialStreamWindowSize parameters in the MSE console.

What are the limitations on adding a service source to a cloud-native gateway?

A single gateway can be associated with up to three ACK clusters.
A single gateway can be associated with only one Nacos instance.

Why am I unable to select an existing Nacos instance or ACK cluster when I add a service source to my cloud-native gateway?

Only Nacos instances or ACK clusters that are in the same virtual private cloud (VPC) as the cloud-native gateway can be added as service sources. Cross-VPC service sources are not supported.

Do cloud-native gateways support self-signed HTTPS certificates?

Cloud-native gateways do not manage certificates but pull certificates from Certificate Management Service. Upload your self-signed certificate to Certificate Management Service and configure the certificate in the domain name settings of the gateway.

Do gateway parameter changes in the MSE console affect existing traffic?

If you change the XffTrustedNum parameter, restart the gateway to make the change take effect.
If you change the UpstreamIdleTimeout parameter, the upstream connection is closed and then re-established.
If you change the DownstreamIdleTime parameter, the downstream connection is closed and then re-established.

What do I do if the health status of port 443 on the CLB instance associated with the cloud-native gateway is abnormal?

If no HTTPS domain name is configured on the gateway, the gateway does not listen to port 443. As a result, the health status of port 443 on the Classic Load Balancer (CLB) instance is abnormal. To resolve the issue, configure an HTTPS domain name for the gateway. For more information, see Associate domain names with a cloud-native gateway. For more information about how to specify listening items in Ingress resource configurations, see Kubernetes Ingress.

What do I do if the health status of a service is abnormal after the service is created on the cloud-native gateway?

To allow the gateway to forward a request to the backend service, make sure that the gateway is connected to the backend service. If the health status of the backend service is abnormal, perform the following operations for troubleshooting:

For an internal-facing service in the VPC, check whether the security group of the backend service allows the gateway to access the relevant port. For more information about how to configure security group rules, see Configure security group rules.
For an Internet-facing service, check whether the VPC can access the Internet. Try to enable the secure network address translation (SNAT) feature of an Internet NAT gateway to access the Internet. For more information, see Use the SNAT feature of an Internet NAT gateway to access the Internet.
For HTTP health checks, check whether the request path and request domain are correctly configured.
For HTTP health checks, if the health check interface of the backend service needs to be accessed over HTTPS, enable one-way Transport Layer Security (TLS) for the backend service in Policies.
For HTTP health checks, if the cause is not identified after you perform the preceding operations, the health check interval may be the same as the persistent connection period of the backend service. Try to increase the health check interval.

How do I identify the cause of a request error reported on the cloud-native gateway?

Check whether the response contains the x-envoy-upstream-service-time header. In normal cases, if the response contains the x-envoy-upstream-service-time header, the gateway has forwarded the request to the backend service for processing. In this case, subsequent request errors are closely related to the logic of the backend service.
Check whether the upstream_service_time field in the access log of the gateway is empty. In normal cases, if the upstream_service_time field in the access log is not empty, the gateway has forwarded the request to the backend service for processing. In this case, subsequent request errors are closely related to the logic of the backend service.

What do I do if an HTTPS certificate does not take effect after it is updated in a cloud-native gateway?

This issue occurs because an HTTPS certificate is configured for the node connected to the gateway such as a CLB instance, Dynamic Content Delivery Network (DCDN), Web Application Firewall (WAF), or Anti-DDoS Proxy. Check whether the connected node also updates the HTTPS certificate. Based on best practices, we recommend that you configure an HTTPS certificate on only one node. If DCDN or WAF is connected to the gateway, configure an HTTPS certificate on only DCDN or WAF, and use HTTP for the backend gateway.

What do I do if the parameter modifications on the cloud-native gateway do not take effect?

This issue occurs because an MseIngressConfig is used to define configurations of the cloud-native gateway. The MSE Ingress gateway automatically synchronizes configuration items in the MseIngressConfig to the MSE console. If you modify the configuration items in the MSE console, the modifications may be overwritten by the subsequent information synchronized from the MSE Ingress gateway. We recommend that you modify configuration items only by using the MseIngressConfig.

What is the sorting method of routing priorities of the cloud-native gateway?

On the Route Settings page of the cloud-native gateway, routes are listed in descending order of route matching priorities. The matching priorities are determined based on domain names or routing rules. For domain name matching, an exact domain name takes precedence over a wildcard domain name. For example, test.example.com takes precedence over *.example.com. For matching of paths of the same domain name, the order of precedence is exact match > prefix match > regular expression match. For matching of the same path of the same domain name, a matching rule that has more conditions takes precedence. The matching conditions can be headers and the Query parameter.

Why do HTTPS requests fail when the cloud-native gateway is connected to DCDN?

This issue occurs because DCDN does not carry a Server Name Indication (SNI) in back-to-origin requests that are sent to the gateway. In this case, add an SNI to the back-to-origin configuration of DCDN.

Why do HTTPS requests fail when the cloud-native gateway is connected to WAF?

This issue occurs because WAF does not carry an SNI in back-to-origin requests that are sent to the gateway. If you add a website to WAF in Canonical Name (CNAME) record mode, select Enable Origin SNI in the Enter Your Website Information step.

Do cloud-native gateways support WebSocket?

Yes. The WebSocket protocol is enabled by default.

Do cloud-native gateways support gRPC?

Yes, cloud-native gateways support gRPC. gRPC uses HTTP/2 to transmit data. Confirm that the EnableHttp2 = true configuration is specified on the Parameter Settings page.

Do cloud-native gateways support the gzip compression algorithm?

Yes, cloud-native gateways support the gzip compression algorithm. Confirm that the EnableGzip = true configuration is specified on the Parameter Settings page. The compression algorithms gzip and Brotli are supported. You can specify the ZipAlgorithm parameter to configure the compression algorithm. By default, the ZipAlgorithm parameter is set to gzip.

Do cloud-native gateways support case preservation of request and response headers?

Yes, cloud-native gateways support case preservation of request and response headers. Confirm that the PreserveHeaderFormat = true configuration is specified on the Parameter Settings page of the gateway. The PreserveHeaderFormat parameter takes effect only when HTTP 1.0 or 1.1 is used. The HTTP/2 protocol requires that all request and response headers be in lowercase.

Do cloud-native gateways support HTTP/3?

Yes, cloud-native gateways support HTTP/3. Confirm that the EnableHttp3 = true configuration is specified on the Parameter Settings page of the gateway.

Do cloud-native gateways support custom listener ports?

Yes, cloud-native gateways support custom listener ports. Cloud-native gateways support HTTP port 80 and HTTPS port 443. To resolve this issue, add a listener port in the CLB console. For example, you can add TCP port 8080. Then, add TCP port 8080 and HTTP port 80 to the same vServer group to allow HTTP requests.

Why do all request and response headers become lowercase after the requests pass through the gateway?

By default, the gateway sets all request and response headers to lowercase. For case preservation, specify the PreserveHeaderFormat = true configuration on the Parameter Settings page.

Why does the access fail when a DNS service is created on the cloud-native gateway?

If the configured Domain Name System (DNS) domain name is a public domain name, enable SNAT of a NAT gateway to allow the gateway to access the Internet. By default, the gateway cannot access the Internet.