Enable HTTP-3 Performance with QUIC Listeners via ALBConfig - Container Service for Kubernetes - Alibaba Cloud - Container Compute Service

Create a QUIC listener on an Application Load Balancer (ALB) instance so that compatible clients can access your Services over HTTP/3. HTTP/3 suits scenarios with complex network environments, fluctuating bandwidth, and strict latency requirements, such as mobile networks, online games, and live video streaming, by reducing data retransmissions and communication latency.

How it works

QUIC is a UDP-based transport protocol and the foundation of HTTP/3. QUIC supports multiplexing, 0-RTT handshakes, efficient congestion control algorithms, and seamless connection migration. Compared with HTTP/2, which runs over TLS and TCP, HTTP/3 over QUIC significantly reduces data retransmissions and communication latency. For more information about QUIC, see the official QUIC documentation.

QUIC listener only — After you create a QUIC listener, the ALB instance allows clients to access Services over HTTP/3.
QUIC listener with an HTTPS listener — If some clients need to access Services over HTTP/1.1 or HTTP/2, use a QUIC listener together with an HTTPS listener to ensure compatibility with multiple HTTP protocols.
When the two listeners are used together, the ALB instance works in the mode shown in the following figure. The QUIC listener and the HTTPS listener listen on the same port and use the same set of forwarding rules. When the ALB instance receives client requests, it gives priority to the QUIC listener when forwarding the requests to backend Services. If a client does not support HTTP/3, the ALB instance forwards the requests over the HTTPS listener.

Prerequisites

An AlbConfig resource is created. For more information, see Get started with ALB Ingress.
An Ingress is created for the Service that you want to expose through ALB Ingress.
A certificate is available for the listeners. The examples in this topic specify the certificate by ID in the AlbConfig. QUIC listeners also support auto-discovered certificates and Secret certificates. For more information, see Configure certificates for encrypted communication over HTTPS.
kubectl is installed and connected to the cluster.
A curl build that supports HTTP/3 is available for verification. Some curl builds do not support HTTP/3 by default.

Use a standalone QUIC listener

Use a standalone QUIC listener when all of your clients support HTTP/3. This configuration declares one QUIC listener in the AlbConfig. If some clients access Services over HTTP/1.1 or HTTP/2, use a QUIC listener together with an HTTPS listener as described in the following section instead.

Step 1: Create a QUIC listener in the AlbConfig

Run the following command to modify the AlbConfig:

kubectl edit albconfig <ALBCONFIG_NAME> # Replace <ALBCONFIG_NAME> with the name of the AlbConfig.

Create a QUIC listener.

apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: alb
spec:
  config:
    #...
  listeners:
    - port: 443
      protocol: QUIC # QUIC listener
      certificates:
      - CertificateId: 756****-cn-hangzhou # The CertIdentifier of the certificate
        IsDefault: true

Step 2: Verify the configuration

Access the Service through ALB Ingress over HTTP/3 to verify that the QUIC listener works as expected.

Run the following command to query the Ingress:
```
kubectl get ingress
```
Record the HOSTS and ADDRESS columns of the output. and ADDRESS columns of the output.
Run the following command to access the Service over HTTP/3. Replace demo.alb.ingress.top and alb-********.alb.aliyuncs.com with the values that you obtained in the previous step.
Note
Some curl builds do not support HTTP/3 by default. Use a curl build that supports HTTP/3.
```
curl --http3 -H HOST:demo.alb.ingress.top -k https://alb-********.alb.aliyuncs.com
```
```
old
```

Use QUIC and HTTPS listeners together

Use a QUIC listener together with an HTTPS listener when some clients access Services over HTTP/1.1 or HTTP/2. The AlbConfig in this configuration declares both listeners, so you do not need to complete the standalone QUIC listener configuration first.

Step 1: Create a QUIC listener and an HTTPS listener in the AlbConfig

Run the following command to modify the AlbConfig:

kubectl edit albconfig <ALBCONFIG_NAME> # Replace <ALBCONFIG_NAME> with the name of the AlbConfig.

Create a QUIC listener and an HTTPS listener on the same port, and add the quicConfig field to the HTTPS listener.

apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: alb
spec:
  config:
    #...
  listeners:
    - port: 443
      protocol: QUIC # QUIC listener
      certificates:
      - CertificateId: 756****-cn-hangzhou # The CertIdentifier of the certificate
        IsDefault: true
    - port: 443
      protocol: HTTPS # HTTPS listener
      certificates:
      - CertificateId: 756****-cn-hangzhou # The CertIdentifier of the certificate
        IsDefault: true
      quicConfig:
        quicListenerId: "" # Leave this field blank for now. You specify the value in Step 3.
        quicUpgradeEnabled: false # Set the value to false.

Step 2: Add an annotation to the Ingress

Add an annotation to the Ingress resource so that the Ingress applies to multiple listeners.

Run the following command to edit the Ingress:

kubectl edit ingress quic-ingress # Replace quic-ingress with the name of the Ingress.

Add the annotations field to the Ingress.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: #...
  annotations:
    alb.ingress.kubernetes.io/listen-ports: '[{"QUIC": 443},{"HTTPS": 443}]' # This annotation is required when you use multiple listeners to ensure that ALB Ingress works as expected.
spec:
  #...

Step 3: Associate the listeners

Associate the QUIC listener with the HTTPS listener, and then confirm in the ALB console that the association is applied.

Log on to the ALB console.
On the Instances page, click the ID of the target ALB instance. On the Listener tab, find the listener whose Listener Protocol/Port is QUIC:443, and record the ID of this listener.

Specify the ID of the QUIC listener in the AlbConfig.

Run the following command to modify the AlbConfig:

kubectl edit albconfig <ALBCONFIG_NAME> # Replace <ALBCONFIG_NAME> with the name of the AlbConfig.

Specify the ID of the QUIC listener in the quicListenerId field, and change the value of the quicUpgradeEnabled field to true.

apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: alb
spec:
  config:
    #...
  listeners:
    - port: 443
      protocol: HTTPS
      certificates:
      - CertificateId: 756****-cn-hangzhou
        IsDefault: true 
      quicConfig: 
        quicListenerId: lsn-tnz740dr8p5h65**** # The listener ID of the specific QUIC listener.
        quicUpgradeEnabled: true # Change the value to true.
    - port: 443
      protocol: QUIC # QUIC listener
      certificates:
      - CertificateId: 756****-cn-hangzhou
        IsDefault: true

Confirm that the listeners are associated.
1. Log on to the ALB console.
2. On the Instances page, click the ID of the target ALB instance. On the instance details page, click the Listener tab. In the listener list, click the name of the target HTTPS listener. On the Listener Details tab, view the associated QUIC listener.

Step 4: Verify the configuration

Step 3 confirms the association in the ALB console. In this step, you access the Service through ALB Ingress from a client to verify that the ALB instance serves requests over both HTTP/3 and HTTPS.

Run the following command to query the Ingress:
```
kubectl get ingress
```
HOSTS and ADDRESS columns of the output.
Run the following command to access the Service over HTTP/3. Replace demo.alb.ingress.top and alb-********.alb.aliyuncs.com with the values that you obtained in the previous step.
Note
Some curl builds do not support HTTP/3 by default. Use a curl build that supports HTTP/3.
```
curl --http3 -H HOST:demo.alb.ingress.top -k https://alb-********.alb.aliyuncs.com
```
```
old
```
Run the following command to access the Service over traditional HTTPS. Replace demo.alb.ingress.top and alb-********.alb.aliyuncs.com with the same values.
```
curl -H HOST:demo.alb.ingress.top -k https://alb-********.alb.aliyuncs.com
```
```
old
```

(Optional) Step 5: Remove the association

Remove the association when you no longer need the HTTPS listener to work with the QUIC listener. Other fields in the AlbConfig remain unchanged.

Run the following command to modify the AlbConfig:

kubectl edit albconfig <ALBCONFIG_NAME> # Replace <ALBCONFIG_NAME> with the name of the AlbConfig.

Clear the quicListenerId field, change the value of the quicUpgradeEnabled field to false, and then save the change and exit.

# The preceding content is omitted.
    - port: 443
      protocol: HTTPS
      quicConfig:
        quicListenerId: "" # Clear the listener ID of the QUIC listener.
        quicUpgradeEnabled: false # Change the value to false.
      requestTimeout: 0
# The following content is omitted.

References

If your Service may suffer network attacks, use a Web Application Firewall (WAF)-enabled ALB instance. For more information, see Use WAF-enabled ALB instances to protect applications.
For more listener configurations, see Use AlbConfigs to configure ALB listeners.