Container Service for Kubernetes:Install the NGINX Ingress controller in high-load scenarios

Parameter description

The following table describes the key parameters in the ConfigMap.

Configure automatic log rotation

By default, the NGINX Ingress controller pod records logs to /dev/stdout. As the log file grows, more resources are consumed to record new logs. You can reduce the resource consumption of log recording by periodically rotating logs. This method saves logs from a specific time period to a separate file and clears the original log records.

1. Log on to the ECS node where the NGINX Ingress controller pod is deployed by using SSH. For more information, see Connect to a Linux instance by using an SSH key pair.

2. Add the nginx-log-rotate.sh file to the /root directory.

   Containerd node

   #!/bin/bash
   # Specify the maximum number of log files that are retained. You can change the number based on your requirements.
   keep_log_num=5
   
   #Get the IDs of all running ingress-nginx containers
   ingress_nginx_container_ids=$(crictl ps | grep nginx-ingress-controller | grep -v pause | awk '{print $1}')
   if [[ -z "$ingress_nginx_container_ids" ]]; then
    echo "error: failed to get ingress nginx container ids"
    exit 1
   fi
   
   # Make the NGINX Ingress controller pods sleep for a time period of a random length between 5 and 10 seconds.
   sleep $(( RANDOM % (10 - 5 + 1 ) + 5 ))
   for id in $ingress_nginx_container_ids; do
    crictl exec $id bash -c "cd /var/log/nginx; if [[ \$(ls access.log-* | wc -l) -gt $keep_log_num ]]; then rm -f \$(ls -t access.log-* | tail -1); fi ; mv access.log access.log-\$(date +%F:%T) ; kill -USR1 \$(cat /tmp/nginx/nginx.pid)"
   done	
   

   Docker node

   #!/bin/bash
   # Specify the maximum number of log files that are retained. You can change the number based on your requirements.
   keep_log_num=5
   
   #Get the IDs of all running ingress-nginx containers
   ingress_nginx_container_ids=$(docker ps | grep nginx-ingress-controller | grep -v pause | awk '{print $1}')
   if [[ -z "$ingress_nginx_container_ids" ]]; then
    echo "error: failed to get ingress nginx container ids"
    exit 1
   fi
   
   # Make the NGINX Ingress controller pods sleep for a time period of a random length between 5 and 10 seconds.
   sleep $(( RANDOM % (10 - 5 + 1 ) + 5 ))
   for id in $ingress_nginx_container_ids; do
    docker exec $id bash -c "cd /var/log/nginx; if [[ \$(ls access.log-* | wc -l) -gt $keep_log_num ]]; then rm -f \$(ls -t access.log-* | tail -1); fi ; mv access.log access.log-\$(date +%F:%T) ; kill -USR1 \$(cat /tmp/nginx/nginx.pid)"
   done	
   	

3. Run the following command to add executable permissions to the nginx-log-rotate.sh file:

   chmod 755 /root/nginx-log-rotate.sh

4. Add the following content to the end of the /etc/crontab file:

   */15 * * * *  root /root/nginx-log-rotate.sh

   Note

   This example uses a cron expression to rotate logs every 15 minutes. You can adjust the frequency based on your requirements.

Enable brotli compression

Although data compression consumes additional CPU time, compressed data packets reduce bandwidth usage, which increases network throughput. Brotli is an open source compression algorithm developed by Google. Compared with the commonly used gzip compression algorithm (which is used by the NGINX Ingress controller by default), Brotli typically achieves a 15% to 30% higher compression ratio for text data such as web resources. However, the specific improvement depends on the details of the scenario. To enable Brotli compression in the NGINX Ingress controller, you need to configure the following parameters:

• enable-brotli: Specifies whether to enable the Brotli compression algorithm. Valid values: true and false.

• brotli-level: The compression level. Valid values: 1 to 11. Default value: 4. A higher compression level requires a higher amount of CPU resources.

• brotli-types: The Multipurpose Internet Mail Extensions (MIME) types for which Brotli real-time compression is used.

You can enable Brotli compression by adding the following configurations to the ConfigMap:

data:
  enable-brotli: "true"
  brotli-level: "6"
  brotli-types: "text/xml image/svg+xml application/x-font-ttf image/vnd.microsoft.icon application/x-font-opentype application/json font/eot application/vnd.ms-fontobject application/javascript font/otf application/xml application/xhtml+xml text/javascript application/x-javascript text/plain application/x-font-truetype application/xml+rss image/x-icon font/opentype text/css image/x-win-bitmap"

HTTPS performance optimization

To improve the HTTPS performance of the NGINX Ingress controller, you can configure the following parameters: SSL session caching, OCSP stapling, TLS 1.3 early data, and cipher suite priorities.

• SSL session caching and timeout

  You can reduce the overhead of SSL handshakes by setting the size of the SSL shared session cache and the time period for reusing sessions stored in the cache.

  • ConfigMap configuration:

    data:
      ssl-session-cache-size: "10m"
      ssl-session-timeout: "10m"

  • The corresponding nginx.conf configuration on the NGINX side. You can adjust the configuration based on your business requirements.

    ssl_session_cache shared:SSL:120m;   # 1m can store 4,000 sessions.
    ssl_session_timeout 1h;              # The session timeout period is 1 hour.

• Enable OCSP stapling

  OCSP stapling reduces the time required for client certificate verification.

  data:
    enable-ocsp: "true"

• Support for TLS 1.3 early data (0-RTT)

  The TLS 1.3 early data feature, also known as zero round trip-time (0-RTT), enables clients to send data before the handshake is completed. This reduces response time.

  data:
    ssl-early-data: "true"
    ssl-protocols: "TLSv1.3"

• Modify the cipher suite priorities (non-manual)

  You can modify the cipher suite priorities to reduce network latency. ACK has optimized cipher suite priorities for the NGINX Ingress controller configurations.

  ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
  ssl_prefer_server_ciphers on;    # Prioritize the cipher configuration on the server side.