Configure the network type for Nginx Ingress Controller - Container Service for Kubernetes

The Nginx Ingress Controller supports three access modes: both public and private network access, public network access only, and private network access only. This satisfies client access requirements across different network environments.

How it works

In the cluster, the SLB instance receives client requests and forwards them to the Nginx Ingress Controller workload. The workload then forwards the requests to other Services.

Configure Nginx Ingress for both public and private network access

Deploy two Services for the backend pods of the Nginx Ingress Controller—one associated with a public SLB instance and the other with a private SLB instance. This enables support for both public and private network access.

Check the current SLB network type.

kubectl describe service -n kube-system nginx-ingress-lb | grep "service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type"

If the output contains intranet, the current type is private. Otherwise, it is public.

Create a new Service to ensure both public and private network types exist.

Create and save a file named nginx-ingress-lb-new.yaml. Run kubectl apply -f nginx-ingress-lb-new.yaml to create the Service.

Add a private network Service

apiVersion: v1
kind: Service
metadata:
  name: nginx-ingress-lb-intranet
  namespace: kube-system
  labels:
    app: nginx-ingress-lb
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type: intranet # Specifies that the SLB instance uses a private network address.
spec:
  type: LoadBalancer
  externalTrafficPolicy: "Cluster"
  ports:
  - port: 80
    name: http
    targetPort: 80
  - port: 443
    name: https
    targetPort: 443
  selector:
    app: ingress-nginx

Add a public network Service

apiVersion: v1
kind: Service
metadata:
  name: nginx-ingress-lb-internet
  namespace: kube-system
  labels:
    app: nginx-ingress-lb
spec:
  type: LoadBalancer
  externalTrafficPolicy: "Cluster"
  ports:
  - port: 80
    name: http
    targetPort: 80
  - port: 443
    name: https
    targetPort: 443
  selector:
    app: ingress-nginx

Replace <service-name> in the following command with the name of your new Service, then run the command. If it returns 200, the new Service is working correctly.
```
curl -s -o /dev/null -w "%{http_code}\n" http://$(kubectl get service -n kube-system <service-name> -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
```
Replace <service-name> with the name of your new Service, then run kubectl get service <service-name>. Record the Service’s External IP and configure DNS based on the Service type:
New private network Service
1. Log on to Alibaba Cloud DNS – Private DNS. On the Authoritative Zone > User Defined Zones tab, click Add Zone. If you have already added the domain, go to step c.
2. In Authoritative Zone, enter your domain name. Keep other options at their defaults and click OK.
3. Click the target domain. On the Settings tab, click Add Record. Fill in the form using the values in the table below. Keep other settings at their defaults and click OK.
  Configuration item
  Value
  Record Type
  A
  Hostname
  Enter a subdomain prefix as needed.
  Record Value
  The IP address of the new Service.
4. Return to the User Defined Zones list. In the Actions column for your target domain, select Effective Scope. Under Effective in VPCs, select the VPC where your ACK cluster resides. Then click OK.
New public network Service
1. Log on to Alibaba Cloud DNS – Public Authoritative DNS. Click your target domain to open the Settings page. Click the Add Record button.
2. Fill in the form using the values in the table below. Keep other settings at their defaults and click OK.
  Configuration item
  Value
  Record Type
  A.
  Hostname
  Enter a subdomain prefix as needed.
  Record Value
  The IP address of the new Service.

Change the network type

Important

This operation deletes and recreates the Service to replace the SLB instance. It causes a temporary interruption to the Nginx Ingress. The deleted SLB instance and its IP address cannot be recovered.

Confirm that the existing SLB instance has no traffic:
1. Log on to the Container Service Management Console. Click your target cluster. In the navigation pane on the left, go to Network > Services. Find nginx-ingress-lb in the kube-system namespace. Record its External IP.
2. Log on to the Classic Load Balancer console. Select the same region as your cluster. Find the CLB instance whose IP Address matches the IP address recorded in the previous step. Click the instance. On the Monitoring tab, verify that the number of connections is 0 before proceeding.
Delete the current Service used by the Nginx Ingress Controller.
```
kubectl delete svc -n kube-system nginx-ingress-lb
```

Create and save a file named nginx-ingress-lb.yaml. Then run kubectl apply -f nginx-ingress-lb.yaml to create the Service.

Important

The new Service name must be nginx-ingress-lb.

Private network Service

apiVersion: v1
kind: Service
metadata:
  name: nginx-ingress-lb
  namespace: kube-system
  labels:
    app: nginx-ingress-lb
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type: intranet # Specifies that the SLB instance uses a private network address.
spec:
  type: LoadBalancer
  externalTrafficPolicy: "Cluster"
  ports:
  - port: 80
    name: http
    targetPort: 80
  - port: 443
    name: https
    targetPort: 443
  selector:
    app: ingress-nginx

Public network Service

apiVersion: v1
kind: Service
metadata:
  name: nginx-ingress-lb
  namespace: kube-system
  labels:
    app: nginx-ingress-lb
spec:
  type: LoadBalancer
  externalTrafficPolicy: "Cluster"
  ports:
  - port: 80
    name: http
    targetPort: 80
  - port: 443
    name: https
    targetPort: 443
  selector:
    app: ingress-nginx

Test the new Service. If it returns 200, the Service is working correctly.

curl -s -o /dev/null -w "%{http_code}\n" http://$(kubectl get service -n kube-system nginx-ingress-lb -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

Run kubectl get service nginx-ingress-lb. Record the Service’s External IP and configure DNS based on the Service type:
New private network Service
1. Log on to Alibaba Cloud DNS – Private DNS. On the Authoritative Zone > User Defined Zones tab, click Add Zone. If you have already added the domain, go to step c.
2. In Authoritative Zone, enter your domain name. Keep other options at their defaults and click OK.
3. Click the target domain. On the Settings tab, click Add Record. Fill in the form using the values in the table below. Keep other settings at their defaults and click OK.
  Configuration item
  Value
  Record Type
  A
  Hostname
  Enter a subdomain prefix as needed.
  Record Value
  The IP address of the new Service.
4. Return to the User Defined Zones list. In the Actions column for your target domain, select Effective Scope. Under Effective in VPCs, select the VPC where your ACK cluster resides. Then click OK.
New public network Service
1. Log on to Alibaba Cloud DNS – Public Authoritative DNS. Click your target domain to open the Settings page. Click the Add Record button.
2. Fill in the form using the values in the table below. Keep other settings at their defaults and click OK.
  Configuration item
  Value
  Record Type
  A.
  Hostname
  Enter a subdomain prefix as needed.
  Record Value
  The IP address of the new Service.

FAQ

Why can’t I create a new Service before deleting the old one?

When changing the network type of the Nginx Ingress Controller, you cannot switch by creating a new Service first and then deleting the old one. You must delete the old Service before creating the new one. During component upgrades, the Nginx Ingress Controller workload matches the Service by its default name (nginx-ingress-lb). Because Services cannot share the same name, creating a new Service before deleting the old one prevents the workload from matching the correct SLB instance, causing the upgrade to fail.

Why does the IP address used by clients differ from the endpoint shown in the console?

The Endpoint shown on the Ingress page in the console is the IP address of the SLB instance associated with the Service named nginx-ingress-lb. When multiple LoadBalancer-type Services are configured, the Nginx Ingress still forwards all requests correctly. However, the console only displays the IP address of the SLB instance tied to the default Service. The actual IP address accessed by clients depends on the SLB instance they use (which you can verify through DNS resolution tests). Therefore, it may differ from the Endpoint shown in the console.

If you delete nginx-ingress-lb and recreate a Service with the same name, you must update the Ingress resource to refresh the displayed endpoint.

How do I roll back after an incorrect change?

Perform these steps in order as soon as possible:

Delete the newly created Service to prevent naming conflicts that would block the component from creating the default Service.
In the console, uninstall and reinstall the Nginx Ingress Controller component, which will create a new default Service in the cluster to restore the Nginx Ingress entry point.
Configure DNS to add domain name resolution for the new default Service (nginx-ingress-lb), and then test if forwarding works properly.

References

For details about configuring annotations for an existing SLB instance, see Use an existing SLB instance.

Configuration item	Value
Record Type	A
Hostname	Enter a subdomain prefix as needed.
Record Value	The IP address of the new Service.