Access services by configuring an ALB Ingress - Container Service for Kubernetes

Application Load Balancer (ALB) Ingresses support HTTP, HTTPS, and QUIC. They are designed for cloud-native applications that require high elasticity and large-scale Layer 7 traffic management. ALB Ingresses are compatible with Nginx Ingresses and support complex business routing configurations and automatic management of TLS certificates, providing a flexible traffic management mechanism. You can configure forwarding rules to use different URLs to access different Services within a cluster.

Prerequisites

You have created an ACK serverless cluster that runs Kubernetes 1.18 or a later version. For more information, see Quick Start for ACK Serverless.
You have created two vSwitches in different zones. The vSwitches must be in the same VPC as the cluster. For more information, see Create and manage vSwitches.
You have installed the ALB Ingress Controller component in the cluster. For more information, see Manage the ALB Ingress Controller component.
Obtain the KubeConfig for your cluster and use kubectl to connect to the cluster.

Notes

If you use the Flannel network plug-in, the backend Services of the ALB Ingress support only the NodePort and LoadBalancer types.
The names of AlbConfig, Namespace, Ingress, and Service resources cannot start with aliyun.
Older Nginx Ingress Controller versions cannot recognize the spec:ingressClassName field in Ingress resources. If an older Nginx Ingress Controller version is installed and both Nginx Ingresses and ALB Ingresses are used in your cluster, the ALB Ingresses may be reconciled by the Nginx Ingress Controller. To prevent this issue, upgrade the Nginx Ingress Controller or use an annotation to specify the ingressClass for the ALB Ingress. For more information, see Upgrade the Nginx Ingress Controller component or Advanced ALB Ingress configurations.

Step 1: Create an AlbConfig

Copy the following content to a file named alb-test.yaml to create an AlbConfig.

apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: alb-demo
spec:
  config:
    name: alb-test
    addressType: Internet
    zoneMappings:
    - vSwitchId: vsw-uf6ccg2a9g71hx8go****
    - vSwitchId: vsw-uf6nun9tql5t8nh15****
  listeners:
    - port: 80
      protocol: HTTP

Parameter	Description
spec.config.name	(Optional) The name of the ALB instance.
spec.config.addressType	(Required) The address type of the load balancer. Valid values: Internet (default): The load balancer has a public IP address. The DNS record is resolved to the public IP address. The load balancer is accessible over the public network. Intranet: The load balancer has only a private IP address. The DNS record is resolved to the private IP address. The load balancer is accessible only from within the VPC where it is deployed.
spec.config.zoneMappings	(Required) The IDs of the vSwitches for the ALB Ingress. You must specify the IDs of at least two vSwitches in different zones. The specified vSwitches must be in zones that are supported by ALB and in the same VPC as the cluster. For more information about the regions and zones supported by ALB, see Regions and zones supported by ALB.

Run the following command to create the AlbConfig.

kubectl apply -f alb-test.yaml

Expected output:

albconfig.alibabacloud.com/alb-demo created

Create a file named alb.yaml and copy the following content to the file to create an IngressClass.

Clusters that run Kubernetes 1.19 or later

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: alb
spec:
  controller: ingress.k8s.alibabacloud/alb
  parameters:
    apiGroup: alibabacloud.com
    kind: AlbConfig
    name: alb-demo

Clusters that run Kubernetes versions earlier than 1.19

apiVersion: networking.k8s.io/v1beta1
kind: IngressClass
metadata:
  name: alb
spec:
  controller: ingress.k8s.alibabacloud/alb
  parameters:
    apiGroup: alibabacloud.com
    kind: AlbConfig
    name: alb-demo

Run the following command to create the IngressClass.

  kubectl apply -f alb.yaml

Expected output:

ingressclass.networking.k8s.io/alb created

Step 2: Deploy services

Create a cafe-service.yaml file with the following content to deploy two Deployments named coffee and tea, and two Services named coffee and tea.

Expand to view the complete YAML file

apiVersion: apps/v1
kind: Deployment
metadata:
  name: coffee
spec:
  replicas: 2
  selector:
    matchLabels:
      app: coffee
  template:
    metadata:
      labels:
        app: coffee
    spec:
      containers:
      - name: coffee
        image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: coffee-svc
spec:
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
  selector:
    app: coffee
  clusterIP: None
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tea
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tea
  template:
    metadata:
      labels:
        app: tea
    spec:
      containers:
      - name: tea
        image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: tea-svc
  labels:
spec:
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
  selector:
    app: tea
  clusterIP: None

Run the following command to deploy the two Deployments and two Services.

kubectl apply -f cafe-service.yaml

Expected output:

deployment "coffee" created
service "coffee-svc" created
deployment "tea" created
service "tea-svc" created

Check the status of the created applications and Services.

Run the following command to check the status of the applications.

kubectl get deploy

Expected output:

NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
coffee                           1/2     2            1           2m26s
tea                              1/1     1            1           2m26s

Run the following command to check the status of the Services.

kubectl get svc

Expected output:

NAME                          TYPE           CLUSTER-IP       EXTERNAL-IP           PORT(S)                 AGE
coffee-svc                    NodePort       172.16.XX.XX     <none>                80:32056/TCP            9m38s
tea-svc                       NodePort       172.16.XX.XX     <none>                80:31696/TCP            9m38s

Step 3: Configure an ALB Ingress

Create a file named cafe-ingress.yaml and copy the following content to it.

Clusters that run Kubernetes 1.19 or later

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress 
spec:
  ingressClassName: alb
  rules:
   - host: demo.domain.ingress.top
     http:
      paths:
      # Configure the context path
      - path: /tea
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 80
      # Configure the context path
      - path: /coffee
        pathType: ImplementationSpecific
        backend:
          service:
            name: coffee-svc
            port: 
              number: 80

Clusters that run Kubernetes versions earlier than 1.19

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: cafe-ingress
spec:
  ingressClassName: alb
  rules:
   - host: demo.domain.ingress.top
     http:
      paths:
      # Configure the context path.
      - path: /tea
        backend:
          serviceName: tea-svc
          servicePort: 80
      # Configure the context path.
      - path: /coffee
        backend:
          serviceName: coffee-svc
          servicePort: 80

Run the following command to configure the domain name and paths to expose the coffee and tea Services.
```
kubectl apply -f cafe-ingress.yaml
```
Expected output:
```
ingress.networking.k8s.io/cafe-ingress created
```

Run the following command to retrieve the address of the ALB instance.

kubectl get ing

Expected output:

NAME           CLASS    HOSTS                         ADDRESS                                               PORTS   AGE
cafe-ingress   alb      demo.domain.ingress.top       alb-m551oo2zn63yov****.cn-hangzhou.alb.aliyuncs.com   80      50s

Step 4: Access the services

Use the command line to access the coffee Service with the retrieved ALB instance address.

curl -H Host:demo.domain.ingress.top http://alb-lhwdm5c9h8lrcm****.cn-hangzhou.alb.aliyuncs.com/coffee

Use the command line to access the tea Service with the retrieved ALB instance address.

curl -H Host:demo.domain.ingress.top http://alb-lhwdm5c9h8lrcm****.cn-hangzhou.alb.aliyuncs.com/tea

References

For information about advanced ALB Ingress configurations, such as how to forward requests from different domain names or URL paths to different backend server groups, configure health checks, redirect HTTP requests to HTTPS, perform phased releases, and configure custom listening ports, see Advanced ALB Ingress configurations.
To customize forwarding rules for an ALB Ingress by configuring forwarding conditions and actions, see Customize forwarding rules for an ALB Ingress.
To configure an HTTPS listener to forward HTTPS requests, see Use an ALB Ingress to configure an HTTPS listener certificate.
If you encounter issues when you use an ALB Ingress, see Troubleshoot ALB Ingress issues and ALB Ingress FAQ.