Use an ALB gateway in Knative for traffic distribution - Container Service for Kubernetes

Application Load Balancer (ALB) provides high-throughput Layer 7 load balancing. Use the ALB gateway—a fully managed gateway with automatic elasticity and canary release support—to distribute traffic for Knative Services that require complex routing, fine-grained traffic splitting, or automatic scaling.

Prerequisites

Knative is deployed in your cluster. For more information, see Deploy Knative.
The ALB Ingress Controller is deployed.
In clusters that use the Flannel network plugin, configure the Kubernetes Service corresponding to Knative as the NodePort type. Add the parameter eni: false to the config-network ConfigMap.
1. Edit the config-network.yaml file.
```
kubectl -n knative-serving edit configmap config-network
```
2. Modify and save the file as follows.
```
apiVersion: v1
data:
  ...
  eni: false  # Add this configuration.
  ...
kind: ConfigMap
metadata:
  name: config-network
  namespace: knative-serving
  ...
```

Step 1: Deploy the ALB gateway

When you deploy the ALB gateway in Knative, you can either use an ALB instance that is automatically created by Knative or specify an existing ALB instance.

Method 1: Automatically create an ALB when deploying the ALB gateway

If you have already deployed Knative, you can also configure the ALB gateway by modifying the Knative configuration file.

Configure the ALB gateway when deploying Knative

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Applications > Knative.
On the Components tab, click Deploy Knative. Then, select ALB as the service gateway, select at least two vSwitches, and then follow the on-screen instructions to complete the Knative deployment.
For details on how to create a vSwitch, see Create VPC and vSwitch.

Deploy the ALB gateway by modifying the Knative configuration file

For a Knative deployment that has already been created, you can configure the ALB gateway by modifying the Knative configuration file. For information about how to deploy Knative, see Deploy Knative in an ACK cluster and Deploy Knative in an ACK Serverless cluster.

Run the following command to edit the config-network.yaml file.
```
kubectl -n knative-serving edit configmap config-network
```

Modify and save the config-network.yaml file as follows.

Modify ingress.class: alb.ingress.networking.knative.dev and set vswitch-ids, and then save and close the config-network file to complete the ALB gateway configuration. For information about the regions and zones that ALB supports, see Regions and zones supported by ALB.

apiVersion: v1
data:
  ...
  ingress.class: alb.ingress.networking.knative.dev # Indicates that ALB is used as the Ingress controller.
  vswitch-ids: vsw-uf6kbvc7mccqia2pi****,vsw-uf66scyuw2fncpn38**** # Replace with the IDs of two vSwitches that you have created in different zones. The system automatically binds these vSwitches when creating the ALB.
  intranet: "true" # Also creates an internal-facing ALB instance.
  internet: "true" # Default: true, indicates that an internet-facing ALB instance is created. If set to false, no internet-facing ALB is created.
  ...
kind: ConfigMap
metadata:
  name: config-network
  namespace: knative-serving
  ...

Important

If only the internal-facing ALB is enabled, the Knative Service must be set to internal access only. To do so, set the label networking.knative.dev/visibility: cluster-local.

Method 2: Use an existing ALB gateway

You can use an existing ALB instance by modifying the Knative configuration file.

Run the following command to edit the config-network.yaml file.
```
kubectl -n knative-serving edit configmap config-network
```

Modify and save the config-network.yaml file as follows.

In the configuration file, modify ingress.class: alb.ingress.networking.knative.dev and set albconfig to an existing ALB. In this case, vswitch-ids does not need to be configured.

apiVersion: v1
data:
  ...
  ingress.class: alb.ingress.networking.knative.dev # Indicates that ALB is used as the Ingress controller.
  albconfig: alb-dev-albconfig # Specify and reuse the name of an existing internet-facing ALBConfig.
  intranet-albconfig: alb-dev-intranet-albconfig # Specify and reuse the name of an existing internal-facing ALBConfig.
...
kind: ConfigMap
metadata:
  name: config-network
  namespace: knative-serving
  ...

Step 2: Access the deployed service through the ALB gateway

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Applications > Knative.

On the Knative page, click the Services tab, select default from Namespace, click Create from Template, paste the following YAML example into the template, and then click Create.

The following example YAML creates a Knative Service named helloworld-go.

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: helloworld-go
spec:
  template:
    spec:
      containers:
      - image: registry-vpc.cn-beijing.aliyuncs.com/knative-sample/helloworld-go:73fbdd56 # Replace the region with the actual region you use.
        env:
        - name: TARGET
          value: "Knative"

On the Services page, get the domain and gateway address of the helloworld-go service from the Default Domain and Access Gateway columns, respectively.

Run the following command to access the helloworld-go service.

curl -H "Host: helloworld-go.default.example.com" http://alb-******.cn-beijing.alb.aliyuncs.com	 # Replace with the actual gateway IP and domain.

Expected output:

Hello Knative!

(Optional) Step 3: View service monitoring data

Knative provides out-of-the-box observability. On the Knative page, click the Monitoring Dashboards tab to view the monitoring data of the target Knative Service. See View the Knative service monitoring dashboard.

Related operations

Configure HTTPS access

Specify a certificate in ALBConfig and enable TLS access in a Knative Service by using the annotation knative.k8s.alibabacloud/tls: "true". Example:

Note

To manage and associate certificates by using Secret, see Configure HTTPS access.

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: helloworld
  namespace: default
  annotations:
    knative.k8s.alibabacloud/tls: "true"
spec:
  template:
    spec:
      containers:
      - image: registry-vpc.cn-shenzhen.aliyuncs.com/knative-sample/helloworld-go:73fbdd56  # Replace the region with the actual region you use.
        env:
        - name: TARGET
          value: "Knative"

Run the following command to access the HTTPS service.

curl -H "Host: helloworld.default.knative.top" https://alb-ppcate4ox6ge9m1wik.cn-shenzhen.alb.aliyuncs.com -k

Expected output:

Hello Knative!

Redirect HTTP requests to HTTPS port 443

You can redirect HTTP requests to HTTPS port 443 in a Knative Service by using the annotation networking.knative.dev/http-protocol. Example:

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: helloworld-go
  annotations:
    networking.knative.dev/http-protocol: redirected
spec:
  template:
    spec:
      containers:
      - image: registry-vpc.cn-beijing.aliyuncs.com/knative-sample/helloworld-go:73fbdd56  # Replace the region with the actual region you use.
        env:
        - name: TARGET
          value: "Knative"

Configure CNAME domain resolution

ALB supports CNAME domain resolution, which lets you point a custom domain to the public service domain of an ALB instance to access various network resources. For details, see Configure a CNAME record for an ALB instance.

Container Service for Kubernetes:Use an ALB gateway in Knative for traffic distribution