Container Service for Kubernetes:Configure an MseIngressConfig

How it works

MSE Ingress Controller watches MseIngressConfig resources in your cluster and dynamically maintains the lifecycle of the corresponding cloud-native gateway and its association with ACK managed, ACK Serverless, and ACS clusters. After the gateway is associated with the API server of an ACK managed, ACK Serverless, or ACS cluster, its control plane syncs Ingress resource changes and updates routing rules in real time. When the gateway receives a request, it matches the request against Ingress routing rules and forwards traffic to the appropriate backend pod.

The following diagram shows the relationship between the components.

The key components are:

• Service: An abstraction of backend services. A service represents a group of replicated pods.

• Ingress: Contains reverse proxy rules that route HTTP or HTTPS requests to services based on hostnames and paths.

• IngressClass: Declares which Ingress controller implementation handles a set of Ingress resources. Associate an IngressClass with an MseIngressConfig to activate the MSE cloud-native gateway for those Ingress resources.

• MseIngressConfig: The CRD that provides gateway configuration—instance specs, network settings, global policies, and Ingress listening scope.

• MSE Ingress Controller: The control plane that manages MSE cloud-native gateway instances and their configurations. It is not a network data plane. It watches MseIngressConfig resources in the cluster and coordinates MSE cloud-native gateway instances to implement the traffic management rules described by Ingress resources.

One MseIngressConfig maps to exactly one MSE cloud-native gateway. To run multiple gateways, create multiple MseIngressConfigs.

MseIngressConfig reference

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: test
spec:
  name: mse-ingress
  common:
    pay:
      payType: POSTPAY
    instance:
      spec: 4c8g
      replicas: 3
    network:
      vSwitches:
      - "vsw-1"
      - "vsw-2"
      publicSLBSpec: slb.s2.small
    securityGroupType: normal
  global:
    tls:
      enableHardwareAcceleration: true
    ipAccessControl:
      whitelist:
      - 1.1.XX.XX
      - 2.2.XX.XX
  monitor:
    logging:
      sls:
        reuseProject: "xxx"   # Leave blank to use the default project
    tracing:
      openTelemetry:
        sampleRate: "100"
  ingress:
    local:
      ingressClass: mse
      watchNamespace: ""      # Leave blank to listen to all namespaces

kubectl get mseingressconfig

NAME   STATUS     MESSAGE
test   Listening

Create an MSE cloud-native gateway

1. Apply an MseIngressConfig to create the gateway. The following example creates a gateway named mse-ingress with 3 replicas at the 2c4g specification.

   apiVersion: mse.alibabacloud.com/v1alpha1
   kind: MseIngressConfig
   metadata:
     name: test
   spec:
     name: mse-ingress
     common:
       instance:
         spec: 2c4g
         replicas: 3

2. Create an IngressClass resource and link it to the MseIngressConfig.

   apiVersion: networking.k8s.io/v1
   kind: IngressClass
   metadata:
     name: mse
   spec:
     controller: mse.alibabacloud.com/ingress
     parameters:
       apiGroup: mse.alibabacloud.com
       kind: MseIngressConfig
       name: test

   After applying both resources, Ingress resources with IngressClass mse are processed by the associated cloud-native gateway.

3. Verify the gateway is running.

   kubectl get mseingressconfig test

   The status progresses through Pending → Running → Listening. When the status shows Listening, the gateway is ready.

Reuse an existing MSE cloud-native gateway

To reuse a gateway that already exists, set spec.id to the gateway's ID (in gw-xxx format) and control whether to overwrite its configuration with spec.override.

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: reuse
spec:
  id: gw-xxxx
  override: false
  ingress:
    local:
      ingressClass: mse

spec.override behavior:

Delete an MSE cloud-native gateway

Deleting an MseIngressConfig deletes the associated gateway in most cases. The exception is reuse scenarios, where the gateway is preserved.

Run the following command to delete an MseIngressConfig:

kubectl delete mseingressconfig <your-config-name>

Deletion behavior by scenario:

Configure IP access control

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: test
spec:
  name: mse-ingress
  global:
    ipAccessControl:
      whitelist:
      - 1.1.XX.XX
      - 2.0.XX.XX/8

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: test
spec:
  name: mse-ingress
  global:
    ipAccessControl:
      blacklist:
      - 1.1.XX.XX
      - 2.0.XX.XX/8

Activate Simple Log Service

Before activating Simple Log Service (SLS), grant SLS permissions to MSE Ingress Controller for your cluster type:

• For an ACK managed cluster or ACK dedicated cluster, follow the ACK dedicated cluster section of Grant permissions to MSE Ingress Controller.

• For an ACK Serverless cluster, follow the ACK Serverless cluster section of Grant permissions to MSE Ingress Controller.

• For an ACS cluster, follow the ACS cluster section of Grant permissions to MSE Ingress Controller.

The following example configures the gateway to deliver access logs to an SLS project named demo. To use the default project instead, leave reuseProject blank.

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: test
spec:
  name: mse-ingress
  monitor:
    logging:
      sls:
        reuseProject: "demo"

Activate Managed Service for OpenTelemetry

Configuring Managed Service for OpenTelemetry enables end-to-end distributed tracing to help diagnose and locate production issues.

The following example sets the sampling rate to 100%.

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: test
spec:
  name: mse-ingress
  monitor:
    tracing:
      openTelemetry:
        sampleRate: "100"

More configurations

The MSE cloud-native gateway instance used by MSE Ingress supports the following additional configurations.

To apply these configurations, log on to the MSE console, go to Cloud-native Gateway > Gateways, locate the existing or automatically created gateway instance that MSE Ingress Controller uses (the instance ID uses the mse_ingresspost-***** format), click the instance ID, and then click Parameters in the left-side navigation pane.