Container Service for Kubernetes:Configure an MseIngressConfig

How it works

MSE Ingress Controller watches MseIngressConfig resources in your cluster and keeps the associated MSE cloud-native gateway in sync. The cluster can be a Container Service for Kubernetes (ACK) managed cluster, ACK Serverless cluster, or ACS cluster.

Once a cloud-native gateway is linked to the cluster's API server, its control plane receives Ingress resource changes and updates routing rules dynamically. When the gateway receives a request, it matches the request against Ingress routing rules and forwards traffic to the corresponding backend pod.

The following components work together in this setup:

• Service: An abstraction over a group of replicated backend pods.

• Ingress: Defines reverse proxy rules that route HTTP or HTTPS traffic to services based on hostnames and URL paths.

• IngressClass: Declares which Ingress controller handles a set of Ingress resources. Associate an MseIngressConfig with the parameters field of an IngressClass to apply MSE routing logic to those Ingress resources.

• MseIngressConfig: A CRD that defines gateway configuration — specs, network settings, global policies, and observability options.

• MSE Ingress Controller: The control plane that manages cloud-native gateways based on MseIngressConfig definitions. It does not handle network data plane traffic directly.

MseIngressConfig reference

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: test
spec:
  name: mse-ingress
  common:
    pay:
      payType: POSTPAY
    instance:
      spec: 4c8g
      replicas: 3
    network:
      vSwitches:
      - "vsw-1"
      - "vsw-2"
      publicSLBSpec: slb.s2.small
    securityGroupType: normal
  global:
    tls:
      enableHardwareAcceleration: true
    ipAccessControl:
      whitelist:
      - 1.1.XX.XX
      - 2.2.XX.XX
  monitor:
    logging:
      sls:
        reuseProject: "xxx" # Leave blank to use the default project.
    tracing:
      openTelemetry:
        sampleRate: "100"
  ingress:
    local:
      ingressClass: mse
      watchNamespace: "" # Leave blank to listen to all namespaces.

kubectl get mseingressconfig

NAME   STATUS    AGE
test   Listening 5m

Create an MSE cloud-native gateway

1. Apply an MseIngressConfig. The following example creates a gateway named mse-ingress with 3 replicas and 2 vCPUs / 4 GB memory. Adjust other fields as needed.

   apiVersion: mse.alibabacloud.com/v1alpha1
   kind: MseIngressConfig
   metadata:
     name: test
   spec:
     name: mse-ingress
     common:
       instance:
         spec: 2c4g
         replicas: 3

2. Create an IngressClass resource and associate it with the MseIngressConfig. This declares MSE Ingress Controller in the cluster, so Ingress resources linked to this IngressClass are handled by the corresponding cloud-native gateway.

   apiVersion: networking.k8s.io/v1
   kind: IngressClass
   metadata:
     name: mse
   spec:
     controller: mse.alibabacloud.com/ingress
     parameters:
       apiGroup: mse.alibabacloud.com
       kind: MseIngressConfig
       name: test

3. Verify the gateway status:

   kubectl get mseingressconfig

   The status should progress from Pending to Running and finally to Listening. A Listening status confirms the gateway is active and watching Ingress resources.

Reuse an existing MSE cloud-native gateway

To reuse an existing gateway, set spec.id to the gateway ID (in gw-xxx format) and configure spec.override to control whether to overwrite the gateway's existing settings.

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: reuse
spec:
  id: gw-xxxx
  override: false
  ingress:
    local:
      ingressClass: mse

Behavior based on `spec.override`:

• `false` (recommended for reuse): The gateway's existing Ingress listening options, TLS hardware acceleration, IP access control, and observability settings are preserved. If the gateway is not yet associated with the cluster, MSE Ingress Controller automatically associates it and configures Ingress listening based on spec.ingress.local.ingressClass. If the gateway is already associated, the existing Ingress listening options are unchanged.

• `true`: The gateway's Ingress listening options, TLS hardware acceleration, global IP access control, and observability settings are overwritten with values from the MseIngressConfig. If the parameters are not specified in the MseIngressConfig, the original parameter settings of the gateway are overwritten and your traffic may be negatively affected. Verify all relevant parameters are set before applying.

Delete an MSE cloud-native gateway

Each MseIngressConfig maps to one cloud-native gateway. In non-reuse scenarios, deleting an MseIngressConfig deletes the associated gateway.

kubectl delete mseingressconfig your-config-name

Deletion behavior depends on billing method and how the gateway was created:

Configure IP access control

The global.ipAccessControl field applies IP filtering at the gateway level, affecting all traffic passing through the gateway. You can configure a whitelist, a blacklist, or both.

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: test
spec:
  global:
    ipAccessControl:
      whitelist:
      - 1.1.XX.XX
      - 2.0.XX.XX/8

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: test
spec:
  global:
    ipAccessControl:
      blacklist:
      - 1.1.XX.XX
      - 2.0.XX.XX/8

Activate Simple Log Service

Simple Log Service (SLS) delivers gateway access logs to a specified SLS project.

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: test
spec:
  monitor:
    logging:
      sls:
        # Leave blank to deliver logs to the default project.
        reuseProject: "demo"

Activate Managed Service for OpenTelemetry

Managed Service for OpenTelemetry enables end-to-end tracing for requests passing through the gateway, helping you diagnose and locate production issues.

Managed Service for OpenTelemetry and open source OpenTelemetry cannot be activated at the same time.

Set monitor.tracing.openTelemetry.sampleRate to the desired sampling percentage. The following example activates tracing with 100% sampling.

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: test
spec:
  monitor:
    tracing:
      openTelemetry:
        sampleRate: "100"