Comparison of Nginx Ingress, ALB Ingress, and MSE Ingress

Type

Scenario

Nginx Ingress

• Your cluster requires highly customized gateways.

• Your cluster performs canary releases and blue-green deployments for cloud-native applications.

ALB Ingress

• Your cluster requires fully managed and O&M-free gateways and components.

• Your cluster requires high-performance auto scaling for Internet applications at Layer 7.

• Your cluster requires multi-level high availability in the service level agreement (SLA) that is up to 99.995%.

• Your cluster performs canary releases and blue-green deployments for cloud-native applications.

• Your cluster uses a single ALB instance to manage traffic for multiple cloud services.

• Your cluster requires disaster recovery in multiple scenarios, such as hybrid cloud and cross-region cloud scenarios.

• Your cluster requires high QPS and a large number of concurrent connections.

MSE Ingress

• Your cluster requires fully managed and O&M-free gateways.

• You cluster adopts the microservices architecture, uses Nacos and ZooKeeper to implement service discovery, uses Sentinel to throttle traffic, has HTTP-to-Dubbo conversion enabled, or is integrated with OpenTelemetry.

• Your cluster requires north-south traffic management and uses traditional registration centers such as Nacos, Kubernetes, DNS, or fixed IP addresses to discover backend services.

• Your cluster requires east-west traffic management, internal communication within hybrid clouds, multiple data centers, and multiple business domains, and seamless integration with service meshes.

• Your cluster uses a gateway that is shared among multiple clusters, multiple PaaS platforms, and multiple Elastic Compute Service (ECS) instances.

• Your cluster requires internal communication within hybrid clouds, multiple data centers, and multiple business domains.

• Your cluster requires authentication, flexible configuration, and enhanced security protection.

• Your cluster requires high QPS and high concurrency.

Type

Nginx Ingress

ALB Ingress

MSE Ingress

Product positioning

• Layer 7 traffic management and advanced routing.

• Highly customizable, self-managed.

• Layer 7 traffic management and advanced routing.

• Deep container integration for application-layer workloads. Supports release strategies including canary release, A/B testing, blue-green deployment, and percentage-based traffic splitting.

• Large capacity, auto scaling, zero O&M.

• Integrates with cloud products such as Web Application Firewall (WAF), Function Compute (FC), PrivateLink, and Transit Router (TR).

• Serves as traditional traffic gateways, microservices gateways, and security gateways. You can use features such as hardware acceleration, WAF local protection, and the plug-in marketplace to build high-performance, highly-scalable, and easy-to-integrate cloud-native gateways that support hot updates.

• Provides traffic management and advanced routing features at Layer 7. Supports multiple service discovery modes and service canary release policies. The service canary release policies include canary release, A/B testing, blue-green deployment, and traffic distribution based on a custom traffic percentage.

• Targets application-layer load balancing scenarios, and are deeply integrated with container services. MSE Ingresses are directly connected to the IP addresses of pods to forward requests.

Product architecture

Based on Nginx with Lua plugin extensions.

• Built on Alibaba Cloud's Apsara Luoshen cloud network platform.

• Based on the self-developed CyberStar platform with auto scaling.

• Developed based on the open source project Higress. Control planes are built based on Istiod and Envoy. For more information about Higress, visit Higress.

• Exclusive to individual users.

Basic routing

• Content-based routing.

• HTTP header modifications, redirects, rewrites, rate limiting, and session persistence.

• Routing based on content and source IP address.

• HTTP header modifications, redirects, rewrites, rate limiting, CORS, and session persistence.

• Forwarding rules for requests and responses.

• Supports content-based routing.

• Supports features such as HTTP header rewrites, redirects, rewrites, throttling, CORS, timeouts, and retries.

• Supports load balancing modes such as standard polling, random, least connections, consistent hashing, and prefetching. In prefetching mode, the traffic that is forwarded to a backend server within the specified time window increases at a steady rate.

• Supports thousands of Ingress rules.

Supported protocols

• Supports HTTP and HTTPS.

• Supports WebSocket, WSS, and gRPC.

• Supports HTTP and HTTPS.

• Supports HTTP3.0, WebSocket, WSS, and gRPC.

• Supports HTTP and HTTPS.

• Supports HTTP 3.0, WebSocket, and gRPC.

• Supports conversion from HTTP/HTTPS to Dubbo.

Configuration changes

• Certificate changes require a process reload, which can disrupt long-lived connections.

• Non-certificate changes use Lua for hot updates.

• Lua plugin changes require a process reload.

Applies configuration changes via OpenAPI, faster than list-watch.

• Supports hot updates of configurations, certificates, and plug-ins.

• The List-Watch mechanism is used to update configurations in real time.

Authentication and authorization

• Supports Basic Auth-based authentication.

• Supports the OAuth protocol.

Supports TLS-based authentication.

• Supports authentication based on Basic Auth, OAuth, JWT, and OIDC.

• Supports integration with Alibaba Cloud IDaaS.

• Supports custom authentication.

Performance

• Requires manual OS and Nginx parameter tuning.

• Requires proper replica count and resource limit configuration.

• Up to 1 million QPS per instance.

• Up to tens of millions of connections per instance.

• SSL hardware acceleration by default.

• When the CPU utilization is 30% to 40%, the transactions per second (TPS) of MSE Ingresses is about 90% higher than the TPS of open source NGINX Ingresses.

• Improves the performance of HTTPS by about 80% after hardware acceleration is enabled.

Observability

• Log collection via Access Log.

• Monitoring with Prometheus.

• Log collection via Access Log (integrates with Log Service).

• Exports monitoring metrics (integrates with CloudMonitor).

• Alerting (integrates with CloudMonitor).

• Allows you to collect access logs by using Simple Log Service and Prometheus.

• Allows you to configure monitoring and alerting by using Prometheus.

• Supports Tracing Analysis and SkyWalking.

O&M

• Self-maintained add-ons.

• Uses Horizontal Pod Autoscaler (HPA) for scaling.

• Manual specification tuning required.

• Fully managed and O&M-free.

• Auto scaling, zero configuration, large capacity.

• Automatically scales for traffic peaks.

Fully managed and O&M-free.

Security

• HTTPS.

• Whitelists and blacklists.

• HTTPS with SSL integration: end-to-end HTTPS, SNI for multiple certificates, RSA and ECC certificates, TLS 1.3, and selectable cipher suites.

• WAF protection (integrates with Alibaba Cloud WAF).

• DDoS protection (integrates with Alibaba Cloud Anti-DDoS).

• Whitelists and blacklists.

• Supports end-to-end encryption for data transfer over HTTPS, Server Name Indication (SNI) for multiple certificates, and custom TLS versions.

• Supports WAF.

• Supports blacklists and whitelists.

Service governance

• Service discovery: Kubernetes.

• Service gradation: Canary releases.

• High availability: Traffic throttling.

• Service discovery: Kubernetes.

• Service gradation: Canary releases.

• High availability: Traffic throttling.

• Supports service discovery based on Kubernetes, Nacos, ZooKeeper, Enterprise Distributed Application Service (EDAS), Serverless App Engine (SAE), DNS, and static IP addresses.

• Allows you to use canary releases to release more than two application versions, supports tag-based routing, and supports end-to-end canary releases based on MSE service governance.

• MSE Ingresses are integrated with Sentinel to support throttling, circuit breaking, and degradation.

• Service testing supports service mocking.

Extensibility

Uses Lua scripts.

Uses AScript. See AScript overview.

• Uses the WebAssembly plug-in to support multiple programming languages.

• Supports Lua for configuring extended features.

Cloud-native integration

• Integrates with Nginx Service Mesh.

• Self-managed add-on. Used with ACK managed or ACK Serverless clusters.

• Integrates with cloud products such as Web Application Firewall (WAF), Function Compute (FC), PrivateLink, and Transit Router (TR).

• Managed add-on. Used with ACK managed or ACK Serverless clusters.

User-side add-on. Used with ACK managed or ACK Serverless clusters. Supports seamless conversion of core Nginx Ingress annotations. See Annotations supported by MSE Ingress.