Container Service for Kubernetes:Expose services with an ALB Ingress

Step 1: Install the ALB Ingress Controller

Step 2: Deploy a sample application

This example deploys a sample Nginx application named coffee as a Deployment and exposes it internally with a Service named coffee-svc.

Step 3: Create an ALB Ingress

By configuring the domain name and path mapping for the ALB Ingress, you can route requests for ingress-demo.com/coffee to the internal coffee-svc service in the cluster.

To use an ALB Ingress in an ACK dedicated cluster, grant access permissions to the ALB Ingress Controller first.

Why am I getting a 503, 502, or 404 error when accessing my Ingress?

Causes

• 503 (Service Temporarily Unavailable) error

  • No matching routing rule: The request path does not match the routing rule configured in the Ingress.

  • No healthy backend pods: All pods associated with the service are not ready or do not exist. This results in an empty endpoint object.

• 502 (Bad Gateway) error

  An HTTP or HTTPS listener receives a client connection request. If the ALB instance cannot forward the request to a pod or receive a response from a pod, the instance sends an HTTP 502 Bad Gateway status code to the client.

• 404 (Not Found) error

  This usually means the request matched a routing rule defined in the Ingress, but does not match the actual service URL provided by the application in the pod.

For more HTTP error codes, see ALB Status Codes.

Solutions

• Check the Ingress status

  Run the command kubectl describe ingress <ingress-name> -n <namespace> and inspect the Events section for error messages. For example, if you see an event similar to listener is not exist in alb, it means you need to create the listener required for the Ingress resource in the AlbConfig.

  ...
  Events:
    Type     Reason                  Age     From     Message
    ----     ------                  ----    ----     -------
    Warning  FailedBuildModel        ****    ingress  listener is not exist in alb, port: 443, protocol: HTTPS
    Warning  FailedBuildModel        ****    ingress  listener not found for (443/HTTPS), with ingresses 1
  ...

• Check the backend endpoints

  Run the command kubectl get endpoints <service-name> -n <namespace> to confirm that the ENDPOINTS field contains at least one healthy pod IP address and port. If the field is empty, verify that the Service's selector matches the labels on your pods, and ensure the pods are in the Running state.

• Check the pod status and logs

  First, run the command kubectl get pod -l <app=your-app> -n <namespace> to check the status of your application pods. Then, run kubectl logs <pod-name> -n <namespace> to inspect the logs of a specific pod for any startup failures or request processing errors.

• Test network connectivity

  From within another pod or directly from a node, use curl to access the backend Service's ClusterIP or a direct pod IP. This will verify that the service is reachable from within the cluster.

Why is HTTPS not working after I configured TLS for an Ingress?

Causes

• Missing HTTPS listener

  You have configured TLS in the Ingress, but the underlying ALB instance is not configured to listen on HTTPS:443.

• Incorrect Secret configuration

  The Secret referenced in your Ingress is not of type kubernetes.io/tls or IngressTLS, or the data field in tls.crt and tls.key are invalid or mismatched.

• Certificate update not synced

  You updated a certificate in the Certificate Management Service, but the change has not propagated to the ALB instance. This can happen if the certificate ID in the AlbConfig was not updated or if the automatic discovery and reconciliation process has not completed. The ALB instance still references the old certificate.

Solutions

1. Verify the ALB listener configuration

   Inspect your AlbConfig resource to ensure an HTTPS listener on port 443 is defined.

   kubectl describe albconfig <alb-name> -n <namespace>

   Look for a listener entry with spec.listeners.port: 443 and spec.listeners.protocol: HTTPS.

2. Check the Ingress annotations

   Ensure your Ingress resource includes the following annotation to associate it with both the HTTP and HTTPS listeners:

   alb.ingress.kubernetes.io/listen-ports: [{"HTTP": 80}, {"HTTPS": 443}]

3. Validate the Secret configuration

   1. Check the spec.tls section of your Ingress manifest to confirm that the secretName field is referencing the correct Secret.

   2. Inspect the Secret itself to verify its type and data integrity:

      kubectl get secret <secret-name> -n <namespace> -o yaml

   Confirm that the type is kubernetes.io/tls and that the tls.crt and tls.key fields contain valid, base64-encoded data.

How do I configure DNS for my Ingress?

1. Register a domain name.

2. Add a CNAME record.

   In your DNS provider's management console, add a CNAME record that points your desired hostname to the Ingress endpoint address.

   Example configuration:

   • Record type: CNAME

   • Host: @ (This typically represents the root domain, such as ingress-demo.com)

   • Value: The endpoint address of your Ingress, such as the address of your ALB instance.

3. Verify the configuration.

   After the DNS record has had time to propagate, open a web browser and navigate to your domain http://ingress-demo.com/coffee. If the page loads successfully, the DNS resolution is working.

   

   Use your actual registered domain name for verification. If the domain name resolution fails, see Quick troubleshooting for domain name resolution failures.

How do I configure HTTPS for an Ingress?

1. Submit an application to a certification authority (CA), purchase an official certificate, and confirm that your certificate is in the issued status.

2. Download the SSL certificate.

   This example shows how to download the PEM-formatted certificate file for the ingress-demo.com domain name. The server type is set to other.

3. Create a Kubernetes Secret for the certificate. You must store your certificate and private key in a Kubernetes Secret so the Ingress controller can access them.

   1. On the Clusters page, click the name of the one you want to change. In the left navigation pane, choose Configurations > Secrets.

   2. On the Secrets page, select the default namespace and click Create in the upper-left corner. Add the following configuration and click OK.

      • Name: ingress-tls

      • Type: TLS Certificate

      • Certificates: Paste the full content of your certificate file (.pem).

      • Key: Paste the full content of your private key file (.key).

      

4. Add an HTTPS listener to your AlbConfig.

   1. In the left navigation pane, choose Workloads > Custom Resources. On the Resource Objects tab, search for and click AlbConfig.

   2. Locate your target AlbConfig resource (such as alb). In the Actions column, click Edit YAML.

   3. Add a new listener for HTTPS on port 443 to the spec.listeners section:

      

   4. Click OK to apply the changes.

5. Update the Ingress to enable TLS.

   1. In the left navigation pane, choose Network > Ingresses. In the Actions column of the target Ingress, click Update.

   2. Add the following configuration and click OK.

      • Turn on TLS Settings

        • Domain Name: ingress-demo.com

        • Secret: ingress-tls

      • Annotations: alb.ingress.kubernetes.io/listen-ports: [{"HTTP": 80}, {"HTTPS": 443}]

6. Open a web browser and navigate to https://ingress-demo.com/coffee. The connection should now be secure and use HTTPS.

   

   Use your own registered domain for verification.

For more information, see Configure HTTPS certificates for encrypted communication.

How do I manually create an AlbConfig and IngressClass?

Create an AlbConfig

1. Log on to the VPC console. Identify and record the IDs of at least two vSwitches that are in different availability zones within your cluster's VPC.

   The Availability Zones of the selected vSwitches must be Regions and zones.

2. Create a file named albconfig.yaml with the following content. Replace the placeholder zoneMappings.vSwitchId values with the actual IDs you recorded in the previous step.

   apiVersion: alibabacloud.com/v1
   kind: AlbConfig
   metadata:
     name: alb # Do not create multiple AlbConfig resources with the same name (alb)
   spec:
     config:
       name: alb-test
       addressType: Internet
       zoneMappings:
       - vSwitchId: vsw-****cg2a9g71hx8go**** # Replace with your actual vSwitch ID
       - vSwitchId: vsw-****un9tql5t8nh15**** # Replace with your actual vSwitch ID
     listeners:
       - port: 80
         protocol: HTTP

3. Run the following command to create the AlbConfig resource in your cluster:

   kubectl apply -f albconfig.yaml

For more detailed instructions, see Create an AlbConfig.

Create an IngressClass

The IngressClass resource associates an AlbConfig with your Ingress resources. By setting ingressClassName: alb in an Ingress manifest, you instruct the controller to use the configuration defined by the IngressClass named alb.

1. Create a file named ingressclass.yaml with the following content.

   The spec.parameters.name field must match the metadata.name of your AlbConfig resource (in this case, alb).

   apiVersion: networking.k8s.io/v1
   kind: IngressClass
   metadata:
     name: alb
   spec:
     controller: ingress.k8s.alibabacloud/alb
     parameters:
       apiGroup: alibabacloud.com
       kind: AlbConfig
       name: alb # This must match the name of the AlbConfig resource

2. Run the following command to create the IngressClass:

   kubectl apply -f ingressclass.yaml

For detailed guidance, see Use an IngressClass to associate an AlbConfig with an Ingress.