Container Service for Kubernetes:Choose a gateway for Knative

Type

ALB

ASM

Kourier

Product positioning

• Layer 7 load balancing tightly integrated with container technology. Suitable for high-capacity workloads that require automatic scaling.

• Supports application-layer protocols: HTTP, HTTPS, and QUIC.

• Supports canary releases, A/B testing, and blue-green deployments. Integrates with WAF, FC, PrivateLink, and TR.

A fully managed service mesh platform compatible with open source Istio. Manages traffic routing and splitting, ensures secure inter-service communication, and provides mesh observability. Reduces operational overhead for development and O&M teams.

A lightweight Envoy-based gateway for Knative Serving. Provides essential routing and service discovery.

Service architecture

• Built on the Alibaba Cloud Apsara Cloud Network platform.

• Based on the self-developed CyberStar platform with automatic scaling.

• Fully managed Istio control plane, compatible with the Istio community.

• A single ASM instance can support services across multiple Kubernetes clusters or services running on Elastic Container Instance (ECI) pods.

• Based on Envoy.

• Replica count and resource limits require manual configuration.

Basic routing

• Content-based and source IP-based routing.

• HTTP header modification, redirection, rewrite, throttling, cross-domain access, and session persistence.

• Forwarding rules for both requests and responses.

• Custom traffic routing rules.

• Multi-cluster routing across Kubernetes clusters.

• Fine-grained traffic management.

• Out-of-the-box chaos engineering capabilities.

• Content-based routing.

• HTTP header modification.

O&M capabilities

• Fully managed and configuration-free.

• Automatic scaling; supports ultra-large capacity.

• Processing capacity scales automatically with business traffic.

• One-click installation, deployment, and upgrades.

• Managed control plane components.

• Lets you focus on business application development.

• Compatible with Istio community specifications.

• Self-managed components.

• Scales via Horizontal Pod Autoscaler (HPA) configurations.

• Requires proactive configuration for performance tuning.

Performance

• Single instance: up to 1 million QPS (queries per second).

• Single instance: tens of millions of concurrent connections.

• SSL hardware acceleration enabled by default.

• Supports multi-region deployment with low-latency access via intelligent DNS parsing.

• Access ASM gateway instances via Classic Load Balancer (CLB).

• The commercial edition supports TLS acceleration using Intel's Multi-Buffer technology, improving QPS by 80% in tests.

Performance depends on manual tuning. Higher load requires proactive HPA and resource configuration.

Supported protocols

HTTP, HTTPS, QUIC, WebSocket, WSS, and gRPC.

• HTTPS with dynamic certificate loading.

• gRPC access through the ingress gateway, including traffic switching between two gRPC service versions.

• Protocol transcoding: access gRPC services using HTTP/JSON.

• WebSocket access through the ingress gateway.

HTTP, HTTPS, and gRPC.

Observability

• Log collection via access logs and metrics.

• Simple Log Service (SLS) integration for access logs.

• CloudMonitor integration for metrics.

• Alerting via CloudMonitor.

• Mesh topology visualization for traffic analysis.

• Self-managed Prometheus integration.

• Application Real-Time Monitoring Service (ARMS) integration.

• SLS integration.

• Custom monitoring metrics.

• Service-level objective (SLO) policies.

Log collection via access logs only.