Container Service for Kubernetes:Access container services with an MSE Ingress

Prerequisites

Ensure that you have:

• An ACK managed cluster, an ACK Serverless cluster, or an ACS cluster running Kubernetes V1.18 or later. Create an ACK managed cluster, Create an ACK Serverless cluster, or Create an ACS cluster. Upgrade if on an earlier version.

• RAM permissions granted to MSE Ingress Controller:

  • ACK managed cluster or ACK Serverless cluster: Grant permissions

  • ACS cluster: Grant permissions

Considerations:

• Before you install MSE Ingress Controller, if an IngressClass resource named mse already exists in your cluster, the gateway and MseIngressConfig resource are not automatically created during installation.mse already exists in your cluster, the gateway and MseIngressConfig resource are not automatically created.

• In new installation mode, installing MSE Ingress Controller creates an MseIngressConfig resource whose lifecycle is bound to the MSE cloud-native gateway instance. Deleting the MseIngressConfig resource cascades deletion of the associated MSE cloud-native gateway. Do not delete MseIngressConfig resources unless instructed.

Step 1: Install MSE Ingress Controller

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, find the target cluster and click its name. In the left-side navigation pane, click Add-ons.

3. On the Add-ons page, search for mse and click Install on the MSE Ingress Controller card.

   

4. In the Install MSE Ingress Controller dialog box, create or select a cloud-native gateway and click OK. If preflight checks fail, authorize MSE Ingress Controller to access MSE.

5. After installation, an MseIngressConfig resource and a cloud-native gateway are automatically created, both named mse-ingress-premium-{clusterid}. To check the gateway status, go to the cluster detail page and choose Workloads > Deployments > Custom Resources. On the Resource Objects tab, search for mse in the API Group section. Wait 3–5 minutes for the phase field to reach Listening before proceeding. Verify from the command line:

   Status	Description
   Pending	The gateway is being created. Wait about 3 minutes.
   Running	The gateway is created and running.
   Listening	The gateway is running and listening to Ingress resources.
   Failed	The gateway is in an invalid state. Check the Message field in Status for the cause.

   kubectl get mseingressconfig -A

   The gateway is ready when the PHASE column shows Listening.

   

6. Log on to the MSE console to confirm that a cloud-native gateway named mse-ingress-premium-{clusterid} exists in your region.

   

Step 2: Deploy a backend service

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, find the target cluster and click its name. In the left-side navigation pane, choose Workloads > Deployments.

3. On the Deployments page, click Create from YAML and apply the following manifest to deploy the httpbin Deployment and Service:

   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: httpbin
     namespace: default
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: httpbin
     template:
       metadata:
         labels:
           app: httpbin
           version: v1
       spec:
         containers:
           - image: registry.cn-hangzhou.aliyuncs.com/mse-ingress/go-httpbin
             args:
               - "--version=v1"
             imagePullPolicy: Always
             name: httpbin
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: httpbin
     namespace: default
   spec:
     ports:
       - port: 8080
         protocol: TCP
     selector:
       app: httpbin

   Verify the Deployment is running:

   kubectl get deployment httpbin -n default

   Expected output:

   NAME      READY   UP-TO-DATE   AVAILABLE   AGE
   httpbin   1/1     1            1           30s

Step 3: Configure an MSE Ingress route

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, find the target cluster and click its name. In the left-side navigation pane, choose Network > Ingresses.

3. On the Ingresses page, click Create Ingress.

4. In the Create Ingress dialog box, set Gateway Type to MSE Ingress and configure the route. Click OK.

   • Set Ingress Class to mse.

   • Under Rule, select Prefix (Prefix-based Match).

   • Set Path to /.

   • Set Service to httpbin.

   

5. Log on to the MSE console to confirm a route containing httpbin is configured. Verify from the command line:

   kubectl get ingress -n default

   Expected output:

   NAME      CLASS   HOSTS   ADDRESS                                               PORTS   AGE
   httpbin   mse     *       nlb-b4ewsj2******.cn-hangzhou.nlb.aliyuncsslb.com    80      30s

   

Step 4: Access the service

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, find the target cluster and click its name. In the left-side navigation pane, choose Network > Ingresses.

3. On the Ingresses page, find the Ingress endpoint in the Address column. The Address column shows the automatically allocated NLB load balancer address, which is the access endpoint for MSE Ingress.Ingresses page, find the Ingress endpoint in the Address column.

   

4. Access the service with the NLB domain name or gateway public IP. For example:

   curl http://nlb-b4ewsj2******.cn-hangzhou.nlb.aliyuncsslb.com/version

   A successful response confirms the service is accessible.

   

Next steps

• Advanced routing: Configure Ingress annotations to enable traffic splitting, canary releases, and request rewriting.

• TLS termination: Configure a certificate on the MSE cloud-native gateway for HTTPS.

• Monitoring: View gateway metrics and access logs in the MSE console.

• Clean up: Delete the httpbin Deployment, Service, and Ingress from the ACK console, or run kubectl delete deployment,service,ingress httpbin -n default.