Container Compute Service:Customize the routing rules of an ALB Ingress

Route traffic based on source IP and request headers

The following Ingress routes requests to gray-hello only when all three conditions are met: the source IP is in 192.168.0.0/16 or 172.16.0.0/16, the gray-hello header value is value1 or value2, and the path is /hello. All other requests go to other Services.

alb.ingress.kubernetes.io/order sets the Ingress priority — lower values take higher priority.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/order: "1"
    alb.ingress.kubernetes.io/conditions.gray-hello: |
      [{
        "type": "Header",
        "headerConfig": {
          "key": "gray-hello",
          "values": [
            "value1",
            "value2"
          ]
        }
       },
       {
         "type": "SourceIp",
         "sourceIpConfig": {
           "values": [
             "192.168.0.0/16",
             "172.16.0.0/16"
           ]
         }
      }]
  name: gray-hello
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /hello
            pathType: ImplementationSpecific
            backend:
              service:
                name: gray-hello
                port:
                  number: 88

Route traffic based on domain name, request method, and cookie

The following Ingress routes requests to service-a only when all conditions match: the domain is www.hostvalue1.edu or www.hostvalue2.edu, the method is GET or HEAD, the cookie cookiekey1 is cookievalue1, and the path is /test. Other requests go to service-b.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/conditions.service-a: |
      [{
        "type": "Cookie",
        "cookieConfig": {
          "values": [
            {
              "key": "cookiekey1",
              "value": "cookievalue1"
            }
          ]
        }
       },
       {
        "type": "Method",
        "methodConfig": {
          "values": [
            "GET",
            "HEAD"
          ]
        }
       },
       {
        "type": "Host",
        "hostConfig": {
          "values": [
            "www.hostvalue1.edu",
            "www.hostvalue2.edu"
          ]
        }
      }]
  name: ingress-example
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /test
            pathType: ImplementationSpecific
            backend:
              service:
                name: service-a
                port:
                  number: 88
          - path: /test
            pathType: ImplementationSpecific
            backend:
              service:
                name: service-b
                port:
                  number: 88

Route traffic based on query string, multiple request headers, and multiple paths

The following Ingress routes requests to service-a when all conditions match: the path is /pathvalue1, /pathvalue2, or /test; the query string querystringkey1 equals querystringvalue2; the header headerkey1 is headervalue1 or headervalue2; and the header headerkey2 is headervalue3 or headervalue4. Other requests go to service-b.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/conditions.service-a: |
      [{
        "type": "Path",
        "pathConfig": {
          "values": [
            "/pathvalue1",
            "/pathvalue2"
          ]
        }
       },
       {
        "type": "QueryString",
        "queryStringConfig": {
          "values": [
            {
              "key": "querystringkey1",
              "value": "querystringvalue2"
            }
          ]
        }
       },
       {
        "type": "Header",
        "headerConfig": {
          "key": "headerkey1",
          "values": [
            "headervalue1",
            "headervalue2"
          ]
        }
       },
       {
        "type": "Header",
        "headerConfig": {
          "key": "headerkey2",
          "values": [
            "headervalue3",
            "headervalue4"
          ]
        }
      }]
  name: ingress-example
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /test
            pathType: ImplementationSpecific
            backend:
              service:
                name: service-a
                port:
                  number: 88
          - path: /test
            pathType: ImplementationSpecific
            backend:
              service:
                name: service-b
                port:
                  number: 88

Return a fixed response with status code 503

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: default
  name: ingress
  annotations:
    alb.ingress.kubernetes.io/actions.response-503: |
      [{
        "type": "FixedResponse",
        "FixedResponseConfig": {
          "contentType": "text/plain",
          "httpCode": "503",
          "content": "503 error text"
        }
      }]
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: response-503
                port:
                  name: use-annotation # Must be use-annotation for fixed response actions

Redirect requests to HTTPS using 301

The following Ingress redirects all HTTP requests to HTTPS using a 301 permanent redirect.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: default
  name: ingress
  annotations:
    alb.ingress.kubernetes.io/actions.redirect: |
      [{
        "type": "Redirect",
        "RedirectConfig": {
          "host": "${host}",
          "path": "${path}",
          "port": "${port}",
          "protocol": "https",
          "query": "${query}",
          "httpCode": "301"
        }
      }]
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: redirect
                port:
                  name: use-annotation # Must be use-annotation for redirect actions

The RedirectConfig parameters:

Insert a request header

The following Ingress inserts a source: alibaba header into all requests before forwarding them to the backend. If the header already exists, it is overwritten.

The Service name in the annotation must match the Service name in the backend field.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: default
  name: ingress
  annotations:
    alb.ingress.kubernetes.io/actions.insert-header: |
      [{
        "type": "InsertHeader",
        "InsertHeaderConfig": {
          "key": "source",
          "value": "alibaba",
          "valueType": "UserDefined"
        }
      }]
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: insert-header
                port:
                  number: 80

Mirror traffic to a server group

The following Ingress mirrors all traffic matching demo.domain.ingress.top/test to a specified server group while continuing to forward the original request normally.

To get a server group ID, log on to the Server Load Balancer (SLB) console, choose ALB > Server Groups, and find the ID on the Server Groups page.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: traffic-mirror-ingress
  annotations:
    # The Service name in the annotation must match the Service name in the backend field.
    alb.ingress.kubernetes.io/actions.traffic-mirror: |
      [{
        "type": "TrafficMirror",
        "TrafficMirrorConfig": {
          "TargetType": "ForwardGroupMirror",
          "MirrorGroupConfig": {
            "ServerGroupTuples": [{
              "ServerGroupID": "sgp-2auud2fxj1r46*****"
            }]
          }
        }
      }]
spec:
  ingressClassName: alb
  rules:
    - host: demo.domain.ingress.top
      http:
        paths:
          - path: /test
            pathType: Prefix
            backend:
              service:
                name: traffic-mirror
                port:
                  number: 80

Forward requests to multiple backend server groups

Distribute requests across multiple backend server groups by weight.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: forward-ingress
  annotations:
    # The Service name in the annotation must match the Service name in the backend field.
    alb.ingress.kubernetes.io/actions.forward: |
      [{
        "type": "ForwardGroup",
        "ForwardConfig": {
          "ServerGroups": [{
            "ServiceName": "tea-svc",
            "Weight": 80,
            "ServicePort": 80
          },
          {
            "ServiceName": "coffee-svc",
            "Weight": 20,
            "ServicePort": 80
          }]
        }
      }]
spec:
  ingressClassName: alb
  rules:
    - host: demo.domain.ingress.top
      http:
        paths:
          - path: /path
            pathType: Prefix
            backend:
              service:
                name: forward
                port:
                  name: use-annotation # Must be use-annotation for forward actions

alb.ingress.kubernetes.io/actions.forward: |
  [{
    "type": "ForwardGroup",
    "ForwardConfig": {
      "ServerGroups": [{
        "ServerGroupID": "sgp-71aexb9y93ypo*****",
        "Weight": 80
      },
      {
        "ServerGroupID": "sgp-slygpbvm2cydo*****",
        "Weight": 20
      }]
    }
  }]

Rewrite the domain name, path, or query string

The following Ingress rewrites the domain name to demo.domain.ingress.top, the path to /test, and the query string to querystring for all requests matching /path.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: default
  name: rewrite-ingress
  annotations:
    alb.ingress.kubernetes.io/actions.rewrite: |
      [{
        "type": "Rewrite",
        "RewriteConfig": {
          "Host": "demo.domain.ingress.top",
          "Path": "/test",
          "Query": "querystring"
        }
      }]
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /path
            pathType: Prefix
            backend:
              service:
                name: rewrite
                port:
                  number: 80

For more information about rewrite rules, see Configure rewrite rules.

Modify a response header based on the response header value

By default, custom routing rules apply to inbound traffic. To apply a rule to outbound traffic (responses), set alb.ingress.kubernetes.io/rule-direction.<service-name> to Response.

The following Ingress inserts a source: alibaba header into the response when the response already contains a response-hello header with value value1 or value2.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/rule-direction.response-header: Response
    alb.ingress.kubernetes.io/conditions.response-header: |
      [{
        "type": "ResponseHeader",
        "responseHeaderConfig": {
          "key": "response-hello",
          "values": [
            "value1",
            "value2"
          ]
        }
      }]
    alb.ingress.kubernetes.io/actions.response-header: |
      [{
        "type": "InsertHeader",
        "InsertHeaderConfig": {
          "key": "source",
          "value": "alibaba",
          "valueType": "UserDefined"
        }
      }]
  name: response-header
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /
            pathType: ImplementationSpecific
            backend:
              service:
                name: response-header
                port:
                  name: use-annotation # Must be use-annotation for outbound routing rules

Remove a response header based on the response status code

The following Ingress removes the response-hello header from responses that return status code 200 or 300.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/rule-direction.response-hello: Response
    alb.ingress.kubernetes.io/conditions.response-hello: |
      [{
        "type": "ResponseStatusCode",
        "responseStatusCodeConfig": {
          "values": [
            "200",
            "300"
          ]
        }
      }]
    alb.ingress.kubernetes.io/actions.response-hello: |
      [{
        "type": "RemoveHeader",
        "RemoveHeaderConfig": {
          "key": "response-hello"
        }
      }]
  name: response-hello
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /*
            pathType: ImplementationSpecific
            backend:
              service:
                name: response-hello
                port:
                  name: use-annotation # Must be use-annotation for outbound routing rules

Limit request rate with QPS throttling

Set a global request rate limit, a per-client-IP rate limit, or both. The QPS throttling action must be combined with a forward action.

annotations:
  alb.ingress.kubernetes.io/actions.traffic-limit: |
    [{
      "type": "TrafficLimit",
      "TrafficLimitConfig": {
        "QPS": "1000",
        "QPSPerIp": "100"
      }
    }]