Use an ALB gateway to distribute traffic in Knative - Container Service for Kubernetes

Use an Application Load Balancer (ALB) gateway to distribute and route traffic for Knative services. This is ideal for applications with complex routing requirements for HTTP and HTTPS requests, such as large-scale web applications that require fine-grained traffic distribution and automatic scaling. ALB is a load balancing service designed for application layer protocols including HTTP, HTTPS, and QUIC. It provides high elasticity and can handle large-scale Layer 7 traffic. The ALB gateway is a fully managed gateway that supports automatic scaling and multiple grayscale release policies.

Prerequisites

Knative is deployed in your cluster. For more information, see Deploy Knative.
The ALB Ingress Controller component is deployed. For more information, see Manage the ALB Ingress Controller component.
For clusters that use the Flannel network plugin, configure the Kubernetes service for Knative as a NodePort service and add the eni: false parameter to the `config-network` ConfigMap.
1. Edit the config-network.yaml file.
```
kubectl -n knative-serving edit configmap config-network
```
2. Modify and save the file in the following format.
```
apiVersion: v1
data:
  ...
  eni: false  # Add this configuration.
  ...
kind: ConfigMap
metadata:
  name: config-network
  namespace: knative-serving
  ...
```

Step 1: Deploy an ALB gateway

When you deploy an ALB gateway in Knative, you can let Knative automatically create an ALB instance or specify an existing ALB instance.

Method 1: Automatically create an ALB instance when deploying the ALB gateway

You can configure the ALB gateway when you deploy Knative. If you have already deployed Knative, you can also configure the ALB gateway by modifying the Knative configuration file.

Configure an ALB Ingress when you deploy Knative

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Applications > Knative.
On the Components tab, click Deploy Knative. On the Deploy Knative page, select ALB for the service gateway, select at least two vSwitches, and then follow the on-screen instructions to complete the deployment.
For more information about how to create a vSwitch, see Create a vSwitch.

Modify the configuration file of Knative to configure an ALB Ingress

If Knative is already deployed, you can configure the ALB gateway by modifying the Knative configuration file. For more information about how to deploy Knative, see Deploy Knative in an ACK cluster and Deploy Knative in an ACK serverless cluster.

Run the following command to edit the config-network.yaml file:
```
kubectl -n knative-serving edit configmap config-network
```

Modify and save the config-network.yaml file in the following format.

After you modify ingress.class: alb.ingress.networking.knative.dev and set vswitch-ids, save the config-network file to configure the ALB gateway. For more information about the regions and zones that ALB supports, see Regions and zones supported by ALB.

apiVersion: v1
data:
  ...
  ingress.class: alb.ingress.networking.knative.dev # Specifies that ALB is used as the Ingress controller.
  vswitch-ids: vsw-uf6kbvc7mccqia2pi****,vsw-uf66scyuw2fncpn38**** # Replace the parameter value with the IDs of two vSwitches that you created in different zones. The system automatically attaches the vSwitches when it creates the ALB instance.
  intranet: "true" # Creates a private ALB instance.
  internet: "true" # The default value is true, which creates a public ALB instance. If you set this to false, a public ALB instance is not created.
  ...
kind: ConfigMap
metadata:
  name: config-network
  namespace: knative-serving
  ...

Important

If you enable only a private ALB instance, you must enable internal-only access for the Knative service. To do this, set the label networking.knative.dev/visibility: cluster-local.

Method 2: Use an existing ALB gateway

You can use an existing ALB instance by modifying the Knative configuration file.

Run the following command to edit the config-network.yaml file:
```
kubectl -n knative-serving edit configmap config-network
```

Modify and save the config-network.yaml file in the following format.

In the configuration file, include the line ingress.class: alb.ingress.networking.knative.dev and set albconfig to an existing ALB instance. In this case, you do not need to configure vswitch-ids.

apiVersion: v1
data:
  ...
  ingress.class: alb.ingress.networking.knative.dev # Specifies that ALB is used as the Ingress controller.
  albconfig: alb-dev-albconfig # Specifies and reuses the name of an existing public ALB instance.
...
kind: ConfigMap
metadata:
  name: config-network
  namespace: knative-serving
  ...

Step 2: Access the deployed service through the ALB gateway

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Applications > Knative.

On the Knative page, click the Services tab. Set Namespace to default, and then click Create from Template. Paste the following sample YAML into the template, and then click Create.

The following sample YAML creates a Knative service named helloworld-go.

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: helloworld-go
spec:
  template:
    spec:
      containers:
      - image: registry-vpc.cn-beijing.aliyuncs.com/knative-sample/helloworld-go:73fbdd56 # Replace the region with the actual region.
        env:
        - name: TARGET
          value: "Knative"

On the Services page, obtain the domain name and gateway address of the helloworld-go service from the Default Domain Name and Access Gateway columns.

Run the following command to access the helloworld-go service:

curl -H "Host: helloworld-go.default.example.com" http://alb-******.cn-beijing.alb.aliyuncs.com	 # Replace the gateway IP address and domain name with the actual values.

Expected output:

Hello Knative!

(Optional) Step 3: View service monitoring data

Knative provides out-of-the-box observability. On the Knative page, click the Dashboard tab to view the monitoring data of the destination Knative service. For more information about how to enable the Knative monitoring dashboard, see View the Knative service monitoring dashboard.

Related operations

Configure HTTPS access

You can specify a certificate in the ALBConfig and enable Transport Layer Security (TLS) access in the Knative service using the annotation knative.k8s.alibabacloud/tls: "true". The following is an example.

Note

To manage and associate certificates using Secrets, see Step 2: Create a Secret certificate.

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: helloworld
  namespace: default
  annotations:
    knative.k8s.alibabacloud/tls: "true"
spec:
  template:
    spec:
      containers:
      - image: registry-vpc.cn-shenzhen.aliyuncs.com/knative-sample/helloworld-go:73fbdd56  # Replace the region with the actual region.
        env:
        - name: TARGET
          value: "Knative"

Run the following command to access the HTTPS service:

curl -H "Host: helloworld.default.knative.top" https://alb-ppcate4ox6ge9m1wik.cn-shenzhen.alb.aliyuncs.com -k

Expected output:

Hello Knative!

Redirect HTTP requests to HTTPS port 443

You can redirect HTTP requests to HTTPS port 443 in the Knative service using the annotation networking.knative.dev/http-protocol. The following is an example.

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: helloworld-go
  annotations:
    networking.knative.dev/http-protocol: redirected
spec:
  template:
    spec:
      containers:
      - image: registry-vpc.cn-beijing.aliyuncs.com/knative-sample/helloworld-go:73fbdd56  # Replace the region with the actual region.
        env:
        - name: TARGET
          value: "Knative"

Configure CNAME resolution

ALB lets you point a custom domain name to the public service domain name of an ALB instance using canonical name (CNAME) resolution. This lets you access various network resources. For more information, see Configure CNAME resolution for an ALB instance.

References

You can enable a custom domain name for a Knative service. For more information, see Use custom domain names and paths.
You can configure HTTPS certificate-based access for a Knative service. For more information, see Configure HTTPS certificate-based access.
You can deploy a gRPC service in Knative to improve network efficiency. For more information, see Deploy a gRPC service in Knative.
You can configure probes to monitor the health and availability of a Knative service. For more information, see Configure probes in Knative.
If your Elastic Container Instance (ECI) needs to connect to the public network, you must attach elastic IP addresses (EIPs). For more information, see Attach an EIP to an ECI instance for public network access.