Container Service for Kubernetes:Configure an MseIngressConfig

How it works

MSE Ingress Controller watches MseIngressConfig resources in your cluster and dynamically maintains the corresponding cloud-native gateway. After the gateway is associated with your cluster's API server, its control plane syncs Ingress resource changes and updates routing rules in real time. When the gateway receives a request, it matches the request against Ingress routing rules and forwards traffic to the appropriate backend pod.

The following diagram shows the relationship between the components.

The key components are:

• Service: An abstraction of backend services. A service represents a group of replicated pods.

• Ingress: Contains reverse proxy rules that route HTTP or HTTPS requests to services based on hostnames and paths.

• IngressClass: Declares which Ingress controller implementation handles a set of Ingress resources. Associate an IngressClass with an MseIngressConfig to activate the MSE cloud-native gateway for those Ingress resources.

• MseIngressConfig: The CRD that provides gateway configuration—instance specs, network settings, global policies, and Ingress listening scope.

• MSE Ingress Controller: The control plane that watches MseIngressConfig resources and coordinates the cloud-native gateway. It does not act as a network data plane.

One MseIngressConfig maps to exactly one MSE cloud-native gateway. To run multiple gateways, create multiple MseIngressConfigs.

MseIngressConfig reference

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: test
spec:
  name: mse-ingress
  common:
    pay:
      payType: POSTPAY
    instance:
      spec: 4c8g
      replicas: 3
    network:
      vSwitches:
      - "vsw-1"
      - "vsw-2"
      publicSLBSpec: slb.s2.small
    securityGroupType: normal
  global:
    tls:
      enableHardwareAcceleration: true
    ipAccessControl:
      whitelist:
      - 1.1.XX.XX
      - 2.2.XX.XX
  monitor:
    logging:
      sls:
        reuseProject: "xxx"   # Leave blank to use the default project
    tracing:
      xTrace:
        sampleRate: "100"
  ingress:
    local:
      ingressClass: mse
      watchNamespace: ""      # Leave blank to listen to all namespaces

kubectl get mseingressconfig

NAME   STATUS     MESSAGE
test   Listening

Create an MSE cloud-native gateway

1. Apply an MseIngressConfig to create the gateway. The following example creates a gateway named mse-ingress with 3 replicas at the 2c4g specification.

   apiVersion: mse.alibabacloud.com/v1alpha1
   kind: MseIngressConfig
   metadata:
     name: test
   spec:
     name: mse-ingress
     common:
       instance:
         spec: 2c4g
         replicas: 3

2. Create an IngressClass resource and link it to the MseIngressConfig.

   apiVersion: networking.k8s.io/v1
   kind: IngressClass
   metadata:
     name: mse
   spec:
     controller: mse.alibabacloud.com/ingress
     parameters:
       apiGroup: mse.alibabacloud.com
       kind: MseIngressConfig
       name: test

   After applying both resources, Ingress resources with IngressClass mse are processed by the associated cloud-native gateway.

3. Verify the gateway is running.

   kubectl get mseingressconfig test

   The status progresses through Pending → Running → Listening. When the status shows Listening, the gateway is ready.

Reuse an existing MSE cloud-native gateway

To reuse a gateway that already exists, set spec.id to the gateway's ID (in gw-xxx format) and control whether to overwrite its configuration with spec.override.

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: reuse
spec:
  id: gw-xxxx
  override: false
  ingress:
    local:
      ingressClass: mse

`spec.override` behavior:

Delete an MSE cloud-native gateway

Deleting an MseIngressConfig deletes the associated gateway in most cases. The exception is reuse scenarios, where the gateway is preserved.

Run the following command to delete an MseIngressConfig:

kubectl delete mseingressconfig <your-config-name>

Deletion behavior by scenario:

Configure IP access control

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: test
spec:
  name: mse-ingress
  global:
    ipAccessControl:
      whitelist:
      - 1.1.XX.XX
      - 2.0.XX.XX/8

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: test
spec:
  name: mse-ingress
  global:
    ipAccessControl:
      blacklist:
      - 1.1.XX.XX
      - 2.0.XX.XX/8

Activate Simple Log Service

Before activating Simple Log Service (SLS), grant SLS permissions to MSE Ingress Controller for your cluster type:

• ACK managed or dedicated cluster: See the "Grant permissions to MSE Ingress Controller in an ACK dedicated cluster" section in Grant permissions to MSE Ingress Controller.

• ACK Serverless cluster: See the "Grant permissions to MSE Ingress Controller in an ACK Serverless cluster" section in Grant permissions to MSE Ingress Controller.

• ACS cluster: See the "Grant permissions to MSE Ingress Controller in an ACS cluster" section in Grant permissions to MSE Ingress Controller.

The following example configures the gateway to deliver access logs to an SLS project named demo. To use the default project instead, leave reuseProject blank.

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: test
spec:
  name: mse-ingress
  monitor:
    logging:
      sls:
        reuseProject: "demo"

Activate Managed Service for OpenTelemetry

Configuring Managed Service for OpenTelemetry enables end-to-end distributed tracing to help diagnose and locate production issues.

The following example sets the sampling rate to 100%.

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: test
spec:
  name: mse-ingress
  monitor:
    tracing:
      xTrace:
        sampleRate: "100"