Container Compute Service:Migrate from Nginx Ingress to MSE Ingress

Prerequisites

• An Nginx Ingress Controller is deployed in your Container Service cluster.

• A Cloud Native Gateway is available. If you do not have one, see Create an MSE Cloud Native Gateway.

Usage notes

• The migration process does not copy your Ingress configurations. Instead, it enables MSE Ingress to reuse your configurations by watching for and parsing changes to your existing Ingress resources in real time.

• During the migration, both the Nginx Ingress Controller and MSE Ingress reflect any changes you make to your Ingress configurations.

• After the migration is complete, do not delete any Ingress configurations that are in use. The migration only enables MSE Ingress to watch for and parse existing and future Ingress configurations.

• After the migration, you must keep existing and future Ingress configurations associated with the original IngressClass. For example, if an Ingress resource previously specified ingressClassName: nginx in its spec, it must continue to do so after the migration.

Migration methods

Migration workflow

Cloud Native Gateway provides a Cloud Migration tool that guides you step-by-step through migrating your routing configurations and shifting traffic.

Step 1: Migrate routing rules

1. Log on to the MSE console. In the top navigation bar, select a region.

2. In the left-side navigation pane, choose Cloud Native Gateway > Migration to Cloud.

3. On the Migration to Cloud page, click Add Task.

4. In the Create Migration Configuration panel, configure the parameters.

   The Cloud Native Gateway watches for all Ingress resources in the selected container cluster that are associated with the source IngressClass. It then applies their domain name and routing configurations.

   Important

   Migration is not allowed if the target Cloud Native Gateway is already associated with this container cluster using a different IngressClass. Ensure the IngressClass specified here matches the one already configured for the cluster.

   Parameter	Description
   Cloud-native Gateway	Select the target Cloud Native Gateway for the migration. The gateway version must be 1.2.22 or later.
   Container Service ACK/ACK Serverless cluster	Select the Container Service cluster that contains the Nginx Ingress to be migrated. Ensure that the Cloud Native Gateway and the container cluster are in the same VPC.
   Source Ingress Class	Specify the IngressClass associated with the Ingress resources that you want to migrate. Note You can specify only one IngressClass. If you leave this parameter empty, IngressClass is ignored, and the gateway watches all Ingress resources in the cluster.
   Description	Enter a description up to 64 characters long.

5. Click Next.

   The Cloud Native Gateway now automatically watches for changes to all Ingress resources that are in the selected container cluster and associated with the source IngressClass. It then applies the domain name and routing configurations from these resources.

   1. Assume you have an Ingress named httpbin in the source container cluster.

   2. On the Cloud Native Gateway console, you will see that the Ingress from the source cluster is automatically synchronized to the target gateway, creating corresponding domain and routing configurations. The Routing Settings details page is displayed as follows:

      1. Configuration wizard:

         1. Add service source

            You can use K8s, Nacos, Zookeeper, SAE, EDAS, and Function Compute (FC) as service sources. You can add an existing resource from your current VPC and then select a registered service from it.

            Button: Add service source

         2. Associate backend service

            Distributes requests to a backend service. This service can be dynamically discovered from a service source or specified by a static address or domain name.

            Button: Associate backend service

         3. Bind domain name

            Provides multi-domain management. By binding a domain name, you can associate protocols, certificates, and routing configurations with different domains.

            Button: Bind domain name

         4. Create route

            A route contains matching rules based on domain names, paths, methods, request parameters, and request headers. When a user accesses a route, the request is forwarded to the corresponding backend service.

            Button: Create route

      2. List columns: Route name, Status, WAF protection, Source, Route condition, Associated domain name, Destination service type, Destination service, and Actions.

Step 2: Verify routes

Check the compatibility of the watched Ingress annotations:

• If there are no incompatible Ingress annotations, proceed to the next step.

• If you find incompatible Ingress annotations, you can submit a ticket for a solution.

  Important

  • You can ignore the annotation nginx.ingress.kubernetes.io/service-weight if its value is "". This annotation is added by default by an earlier version of the Container Service console and has no effect.

  • During the migration, do not remove incompatible annotations that are in use. These annotations are still parsed by the Nginx Ingress Controller and affect your business traffic. You can add extended MSE annotations to the Ingress resource to achieve the same functionality in MSE Ingress. After all traffic is migrated to MSE Ingress, you can remove the incompatible annotations as needed.

Step 3: Select shifting method

Test before shifting traffic

Before you shift production traffic, perform a local test. Modify your local hosts file to resolve the business domain name to the Cloud Native Gateway SLB. Use a tool like cURL or Postman to verify that all traffic behaves as expected.

Select shifting method

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-id: lb-bp1lc0huzf0o1ks333yo1
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-weight: '100'
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-vgroup-port: 'rsp-bp1uybv6iy50i:80,rsp-bp10s0ndrfvdt:443'
  creationTimestamp: '2023-11-29T07:14:40Z'
  finalizers:
    - service.k8s.alibaba/resources
  labels:
    app: nginx-ingress-lb
    service.beta.kubernetes.io/hash: 39a51bd97b88f6eaf232da33434ce2fe44ae094b7b4d2b9bb9126eb7
    service.k8s.alibaba/loadbalancer-id: lb-bp1lc0huzf0o1ks333yo1
  managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        'f:metadata':
          'f:annotations':
            .: {}
            'f:kubectl.kubernetes.io/last-applied-configuration': {}
            'f:service.beta.kubernetes.io/alibaba-cloud-loadbalancer-connection-drain': {}
            'f:service.beta.kubernetes.io/alibaba-cloud-loadbalancer-connection-drain-timeout': {}
            'f:service.beta.kubernetes.io/alibaba-cloud-loadbalancer-instance-charge-type': {}
            'f:service.beta.kubernetes.io/alibaba-cloud-loadbalancer-resource-group-id': {}
          'f:labels':
            .: {}
            'f:app': {}