Container Service for Kubernetes:Configure ALB instances with AlbConfig

AlbConfig parameters

Default AlbConfig configuration

When you install the ALB Ingress Controller with a default AlbConfig, the following settings are applied (except for vSwitchId, which you must specify):

apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: alb
spec:
  config:
    accessLogConfig:
      logProject: ""
      logStore: ""
    addressAllocatedMode: Dynamic
    addressType: Internet
    billingConfig:
      internetBandwidth: 0
      internetChargeType: ""
      payType: PostPay
    deletionProtectionEnabled: true
    edition: Standard
    forceOverride: false
    zoneMappings:
    - vSwitchId: #...
    - vSwitchId: #...
status:
  loadBalancer:
    dnsname: alb-s2em8fr9debkg5****.cn-shenzhen.alb.aliyuncsslb.com
    id: alb-s2em8fr9debkg5****

Override behavior

Step 1: Create an IngressClass

Create a file named ingress_class.yaml with the following content:

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: alb
spec:
  controller: ingress.k8s.alibabacloud/alb
  parameters:
    apiGroup: alibabacloud.com
    kind: AlbConfig
    name: alb  # Name of the AlbConfig to associate

apiVersion: networking.k8s.io/v1beta1
kind: IngressClass
metadata:
  name: alb
spec:
  controller: ingress.k8s.alibabacloud/alb
  parameters:
    apiGroup: alibabacloud.com
    kind: AlbConfig
    name: alb

Run the following command to create the IngressClass:

kubectl apply -f ingress_class.yaml

Expected output:

ingressclass.networking.k8s.io/alb created

Step 2: Create an Ingress that references the IngressClass

Create a file named ingress.yaml with the following content. The ingressClassName field links this Ingress to the AlbConfig through the IngressClass.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
spec:
  ingressClassName: alb
  rules:
  - http:
      paths:
      - path: /tea
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 80
      - path: /coffee
        pathType: ImplementationSpecific
        backend:
          service:
            name: coffee-svc
            port:
              number: 80

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: cafe-ingress
spec:
  ingressClassName: alb
  rules:
  - http:
      paths:
      - path: /tea
        backend:
          serviceName: tea-svc
          servicePort: 80
      - path: /coffee
        backend:
          serviceName: coffee-svc
          servicePort: 80

Run the following command to create the Ingress:

kubectl apply -f ingress.yaml

Expected output:

ingress.networking.k8s.io/cafe-ingress created

Enable IPv6 dual-stack

Set addressIpVersion to DualStack to enable both IPv4 and IPv6:

apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: alb
spec:
  config:
    addressIpVersion: DualStack
    ...

Associate an Internet Shared Bandwidth instance

To share bandwidth across ALB instances, specify the bandWidthPackageId in the billingConfig section. This setting applies only to Internet-facing ALB instances (addressType: Internet).

For more information about Internet Shared Bandwidth, see Create and manage an Internet Shared Bandwidth instance.

apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: alb
spec:
  config:
    name: alb
    addressType: Internet
    edition: Standard
    zoneMappings:
    - vSwitchId: vsw-2vcqeyvwsnd***
    - vSwitchId: vsw-2vcbhjlqu7y***
    billingConfig:
      bandWidthPackageId: cbwp-2vcjucp49otd8qolhm***

Specify a certificate

Set the certificates field in the listener configuration to bind a certificate to an HTTPS listener. The first certificate is the default certificate.

If no certificate is specified, the listener is not created at ALB creation time. Instead, the listener is created only after an Ingress is associated and a certificate is auto-discovered based on the domain name.

For more information, see Configure an HTTPS certificate for encrypted communication.

listeners:
- caEnabled: false
  certificates:
  - CertificateId: 756****-cn-hangzhou
    IsDefault: true
  port: 443
  protocol: HTTPS

Specify a TLS security policy

For HTTPS listeners, specify a TLS security policy using the securityPolicyId field. Both custom and system default policies are supported. For more information, see TLS security policies.

listeners:
- port: 443
  protocol: HTTPS
  securityPolicyId: tls_cipher_policy_1_1

Set the request timeout

The requestTimeout field specifies how long (in seconds) the ALB instance waits for a backend response. Valid values: 1 to 600. Default: 60 seconds. If the backend does not respond within the timeout, ALB returns an HTTP 504 error to the client.

listeners:
- port: 80
  protocol: HTTP
  requestTimeout: 40

Enable data compression

Set gzipEnabled to true to compress responses. When the client supports both Brotli and Gzip, ALB prioritizes Brotli for better compression.

Compression is applied when both of the following conditions are met:

• The Content-Length response header exceeds 1024 bytes.

• The Accept-Encoding request header includes a supported algorithm.

Brotli compresses all file types. Gzip compresses the following types: text/xml, text/plain, text/css, application/javascript, application/x-javascript, application/rss+xml, application/atom+xml, application/xml, and application/json.

listeners:
- port: 80
  protocol: HTTP
  gzipEnabled: true

Configure X-Forwarded-For headers

Add client and ALB metadata to HTTP request headers forwarded to backend services.

listeners:
- port: 80
  protocol: HTTP
  xForwardedForConfig:
    XForwardedForEnabled: true
    XForwardedForClientSrcPortEnabled: true
    XForwardedForProtoEnabled: true
    XForwardedForSLBIdEnabled: true
    XForwardedForSLBPortEnabled: true

Specify trusted proxy IP addresses

Use XForwardedForClientSourceIpsEnabled and XForwardedForClientSourceIpsTrusted to extract the client's actual IP from the X-Forwarded-For header when requests pass through known proxies. ALB traverses the IP list in X-Forwarded-For in reverse order and selects the first IP that is not in the trusted list.

For example, if X-Forwarded-For is <client IP, proxy-1, proxy-2>, set XForwardedForClientSourceIpsTrusted to proxy-1;proxy-2 to extract the client IP.

listeners:
- port: 80
  protocol: HTTP
  xForwardedForConfig:
    XForwardedForClientSourceIpsEnabled: true
    XForwardedForClientSourceIpsTrusted: 192.168.x.x;192.168.x.x/16  # Separate IPs/CIDRs with semicolons. No spaces.

Configure ACL-based access control

Control which clients can access your ALB listener by configuring an access control list (ACL). For more information, see Configure an ACL to implement access control.

listeners:
- port: 80
  protocol: HTTP
  aclConfig:
    aclEntries:
    - 127.0.0.1/32
    aclType: White

How the listeners field is updated

The listeners field is an array that is updated by replacement. When you apply a new configuration, the system compares three states to determine the result:

Example:

Given the following three states:

# New config (object configuration file)
listeners:
- port: 8001
  protocol: HTTP
- port: 8003
  protocol: HTTP
- port: 8005    # New
  protocol: HTTP

# Existing config
listeners:
- port: 8001
  protocol: HTTP
- port: 8002    # To be deleted
  protocol: HTTP
- port: 8003
  protocol: HTTP
- port: 8004    # To be deleted
  protocol: HTTP

# last-applied-configuration
listeners:
- port: 8001
  protocol: HTTP
- port: 8002    # To be deleted
  protocol: HTTP
- port: 8003
  protocol: HTTP

The resulting listeners configuration:

listeners:
- port: 8001    # Retained (rule 1)
  protocol: HTTP
- port: 8003    # Retained (rule 1)
  protocol: HTTP
- port: 8005    # Added (rule 2)
  protocol: HTTP

• Ports 8001 and 8003: retained (rule 1).

• Port 8005: added (rule 2).

• Port 8002: deleted (rule 3 -- present in last-applied-configuration).

• Port 8004: deleted (rule 4 -- not in last-applied-configuration, but absent from new config).

Delete an AlbConfig that created the ALB instance

Deleting the AlbConfig also deletes the associated ALB instance.

kubectl delete AlbConfig <AlbConfig_NAME>

Replace <AlbConfig_NAME> with the name of the AlbConfig.

Delete an AlbConfig for a reused ALB instance

Deleting the AlbConfig does not delete the ALB instance itself, because the instance was not created by the AlbConfig.

1. (ALB Ingress Controller v2.10.0-aliyun.1 or earlier only) Edit the AlbConfig and remove all entries under spec.listeners: Skip this step if your ALB Ingress Controller version is later than v2.10.0-aliyun.1.

      kubectl edit albconfig <AlbConfig_NAME>

2. Delete the AlbConfig:

   Important

   Delete all associated Ingress resources before running this command.

      kubectl delete AlbConfig <AlbConfig_NAME>

Delete a listener

Remove the listener entry from spec.listeners using kubectl edit. An ALB instance can have multiple listeners; remove only the ones you no longer need.

# Before: two listeners
listeners:
- port: 8001
  protocol: HTTP
- port: 8002    # Remove this listener
  protocol: HTTP

# After: one listener
listeners:
- port: 8001
  protocol: HTTP

Error: alb: listener port number must between [1:65535], or you should set listen port explicitly in listener config

This typically happens when an extra - (dash) is placed before certificates in the YAML file, which creates a separate listener entry without a port.

Incorrect:

listeners:
- port: 80
  protocol: HTTP
- port: 443
  protocol: HTTPS
- certificates:           # Extra "-" creates a new listener without a port
  - CertificateId: 756****-cn-hangzhou
    IsDefault: true

Correct:

listeners:
- port: 80
  protocol: HTTP
- port: 443
  protocol: HTTPS
  certificates:           # No "-" -- certificates belongs to the port 443 listener
  - CertificateId: 756****-cn-hangzhou
    IsDefault: true

Remove the - before certificates so that the certificate configuration is part of the HTTPS listener on port 443.