Container Compute Service:Use AlbConfigs to configure ALB listeners

Prerequisites

Before you begin, ensure that you have:

• An ACS cluster. See Create an ACS cluster.

• Two vSwitches in different zones within the same virtual private cloud (VPC) as the cluster, in zones supported by ALB. See Create and manage vSwitches.

• The ALB Ingress controller installed in the cluster. See Manage the ALB Ingress controller.

• An AlbConfig created. See Create an AlbConfig.

• An IngressClass created. See Create an IngressClass.

• kubectl connected to the cluster. See Obtain the kubeconfig file of a cluster and use kubectl to connect to the cluster.

Listener parameters at a glance

All listener parameters are set under spec.listeners[] in the AlbConfig. The following table lists the available fields.

How listener updates work

The listeners field is an array. When you apply a new AlbConfig, each entry is matched against the live configuration and the last-applied-configuration annotation to determine what to add, retain, or delete.

listeners:
- port: 8001
  protocol: HTTP
- port: 8003
  protocol: HTTP
- port: 8005  # Adding port 8005.
  protocol: HTTP

listeners:
- port: 8001
  protocol: HTTP
- port: 8002  # Not in new config; in last-applied-configuration.
  protocol: HTTP
- port: 8003
  protocol: HTTP
- port: 8004  # Not in new config; not in last-applied-configuration.
  protocol: HTTP

listeners:
- port: 8001
  protocol: HTTP
- port: 8002
  protocol: HTTP
- port: 8003
  protocol: HTTP

listeners:
- port: 8001
  protocol: HTTP
- port: 8003
  protocol: HTTP
- port: 8005
  protocol: HTTP

Create a listener

ALB listeners receive and forward external requests based on application-layer information. Set port and protocol to create a listener.

apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: alb-demo
spec:
  listeners:
  - port: 80
    protocol: HTTP  # Valid values: HTTP, HTTPS, QUIC.

HTTP is compatible with WebSocket. No additional configuration is required.

Apply the configuration:

kubectl edit albconfig <AlbConfig_Name>

Specify certificates for an HTTPS listener

Bind a certificate to an HTTPS listener using the certificates field. ALB uses the first certificate in the list as the default certificate and switches to others when the default expires or no longer meets requirements.

If no certificate is specified, ALB does not create the HTTPS listener immediately. Instead, it waits for an Ingress to be associated with the listener and auto-discovers a certificate based on the domain name in the Ingress configuration. This delays listener creation.

For details on certificate configuration, see Configure HTTPS certificates for encrypted communication.

listeners:
- port: 443
  protocol: HTTPS
  caEnabled: false
  certificates:
  - CertificateId: 756****-cn-hangzhou  # The certificate ID.
    IsDefault: true

Configure a TLS security policy

Apply a TLS security policy to an HTTPS listener using securityPolicyId. Both custom and default TLS security policies are supported. See TLS security policies.

listeners:
- port: 443
  protocol: HTTPS
  securityPolicyId: tls_cipher_policy_1_1  # The security policy ID.

Set the connection timeout

Set requestTimeout to prevent clients from waiting indefinitely for backend responses. If the backend does not respond within the timeout period, ALB returns HTTP 504 to the client.

• Valid values: 1–180 seconds

• Default: 60 seconds

listeners:
- port: 80
  protocol: HTTP
  requestTimeout: 60  # Unit: seconds. Valid values: 1–180.

Enable data compression

Set gzipEnabled to reduce response payload size and improve transmission efficiency.

• true: enables compression. Both Brotli and Gzip algorithms are used.

  • Brotli supports all file types.

  • Gzip supports: text/plain, text/css, application/javascript, application/x-javascript, application/rss+xml, application/atom+xml, application/xml, application/json.

• false: disables compression.

listeners:
- port: 80
  protocol: HTTP
  gzipEnabled: false  # Set to true to enable compression.

Configure X-Forwarded-For headers

The xForwardedForConfig block controls what information ALB appends to the X-Forwarded-For header. HTTP and HTTPS listeners only.

listeners:
- port: 80
  protocol: HTTP
  xForwardedForConfig:
    XForwardedForEnabled: true

listeners:
- port: 80
  protocol: HTTP
  xForwardedForConfig:
    XForwardedForProtoEnabled: true

listeners:
- port: 80
  protocol: HTTP
  xForwardedForConfig:
    XForwardedForSLBIdEnabled: true

listeners:
- port: 80
  protocol: HTTP
  xForwardedForConfig:
    XForwardedForSLBPortEnabled: true

listeners:
- port: 80
  protocol: HTTP
  xForwardedForConfig:
    XForwardedForClientSourceIpsEnabled: true  # Must be true before XForwardedForClientSourceIpsTrusted takes effect.
    XForwardedForClientSourceIpsTrusted: 192.168.x.x;192.168.x.x/16  # Semicolon-separated IP addresses or CIDR blocks.

Configure network ACLs

Use aclConfig to allow or deny access from specific IP addresses or CIDR blocks. See Configure an ACL to enable access control.

listeners:
- port: 80
  protocol: HTTPS
  aclConfig:
    aclType: White  # White (whitelist) or Black (blacklist).
    aclEntries:
    - 127.0.0.1/32  # IP address or CIDR block to allow or deny.

Delete a listener

To delete a listener, remove its entry from spec.listeners in the AlbConfig.

# Before deletion:
listeners:
- port: 8001
  protocol: HTTP
- port: 8002
  protocol: HTTP

# After deletion (port 8002 removed):
listeners:
- port: 8001
  protocol: HTTP

What's next

• Configure HTTPS certificates for encrypted communication

• Configure an ACL to enable access control

• TLS security policies