Container Compute Service:Use QUIC listeners to support HTTP/3 and improve network performance

Add a QUIC listener to the AlbConfig

1. Open the AlbConfig for editing:

   kubectl edit albconfig <ALBCONFIG_NAME>

2. Add a QUIC listener under spec.listeners:

   In addition to a directly specified certificate ID, QUIC listeners support auto certificate and Secret discovery. For details, see Configure an HTTPS certificate for encrypted communication.

   apiVersion: alibabacloud.com/v1
   kind: AlbConfig
   metadata:
     name: alb
   spec:
     config:
       #...
     listeners:
       - port: 443
         protocol: QUIC       # QUIC requires TLS; port 443 is standard for HTTPS/QUIC.
         certificates:
         - CertificateId: 756****-cn-hangzhou   # The ID of the ALBConfig certificate.
           IsDefault: true

Verify the configuration

1. Get the Ingress details:

   kubectl get ingress

   Expected output:

   NAME            CLASS                HOSTS                  ADDRESS                         PORTS     AGE
   https-ingress   https-ingressclass   demo.alb.ingress.top   alb-********.alb.aliyuncs.com   80, 443   83m

   Note the values in the HOSTS and ADDRESS columns.

2. Test HTTP/3 access. Replace demo.alb.ingress.top and alb-********.alb.aliyuncs.com with the values from the previous step:

   Not all curl builds include HTTP/3 support. Use a version compiled with HTTP/3 support.

   curl --http3 -H HOST:demo.alb.ingress.top -k https://alb-********.alb.aliyuncs.com

   If the QUIC listener is active, the command returns:

   old

Step 1: Define both listeners in the AlbConfig

The complete AlbConfig for this scenario looks like this:

apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: alb
spec:
  config:
    #...
  listeners:
    - port: 443
      protocol: QUIC          # Same port as HTTPS — required for protocol compatibility and shared forwarding rules.
      certificates:
      - CertificateId: 756****-cn-hangzhou   # The ID of the certificate.
        IsDefault: true
    - port: 443
      protocol: HTTPS
      certificates:
      - CertificateId: 756****-cn-hangzhou   # Use the same certificate as the QUIC listener.
        IsDefault: true
      quicConfig:
        quicListenerId: ""             # Leave blank — the QUIC listener ID is not yet available.
        quicUpgradeEnabled: false      # Set to true in Step 3 after you retrieve the listener ID.

To apply this configuration:

1. Open the AlbConfig for editing:

   kubectl edit albconfig <ALBCONFIG_NAME>

2. Add both listeners as shown above and save.

QUIC listeners support auto certificate and Secret discovery in addition to directly specified certificate IDs.

Step 2: Add annotations to the Ingress

When multiple listeners share a port, add the listen-ports annotation so ALB knows which protocols the Ingress serves:

1. Open the Ingress for editing:

   kubectl edit ingress quic-ingress

2. Add the annotation:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: #...
     annotations:
       # Required when multiple listeners share a port — tells ALB which protocols this Ingress handles.
       alb.ingress.kubernetes.io/listen-ports: '[{"QUIC": 443},{"HTTPS": 443}]'
   spec:
     #...

Step 3: Associate the QUIC and HTTPS listeners

After ALB provisions both listeners, link them so ALB can prefer QUIC and fall back to HTTPS automatically:

1. Log on to the ALB console.

2. Log on to the ALB console.

3. On the Instances page, click the ID of your ALB instance. On the Listener tab, find the listener with Listener Protocol/Port set to QUIC:443 and copy its ID.

4. Open the AlbConfig for editing:

   kubectl edit albconfig <ALBCONFIG_NAME>

5. Set quicListenerId to the ID you copied and set quicUpgradeEnabled to true:

   apiVersion: alibabacloud.com/v1
   kind: AlbConfig
   metadata:
     name: alb
   spec:
     config:
       #...
     listeners:
       - port: 443
         protocol: HTTPS
         certificates:
         - CertificateId: 756****-cn-hangzhou
           IsDefault: true
         quicConfig:
           quicListenerId: lsn-tnz740dr8p5h65****   # The ID of the QUIC listener retrieved from the console.
           quicUpgradeEnabled: true                  # Activates the QUIC-to-HTTPS fallback.
       - port: 443
         protocol: QUIC
         certificates:
         - CertificateId: 756****-cn-hangzhou
           IsDefault: true

6. Confirm the association in the console:

   1. Log on to the ALB console.

   2. On the Instances page, click your ALB instance ID. On the Listener tab, click the HTTPS listener name. On the Listener Details page, verify that the associated QUIC listener is listed.

Step 4: Verify the configuration

1. Get the Ingress details:

   kubectl get ingress

   Expected output:

   NAME            CLASS                HOSTS                  ADDRESS                         PORTS     AGE
   https-ingress   https-ingressclass   demo.alb.ingress.top   alb-********.alb.aliyuncs.com   80, 443   83m

   Note the values in the HOSTS and ADDRESS columns.

2. Test both HTTP/3 and standard HTTPS access. Replace demo.alb.ingress.top and alb-********.alb.aliyuncs.com with the values from the previous step:

   Not all curl builds include HTTP/3 support. Use a version compiled with HTTP/3 support.

   curl --http3 -H HOST:demo.alb.ingress.top -k https://alb-********.alb.aliyuncs.com
   curl -H HOST:demo.alb.ingress.top -k https://alb-********.alb.aliyuncs.com

   If both listeners are associated and working, both commands return:

   old
   old

Step 5: (Optional) Remove the association

1. Open the AlbConfig for editing:

   kubectl edit albconfig <ALBCONFIG_NAME>

2. Clear quicListenerId and set quicUpgradeEnabled to false:

   # Content above is omitted.
       port: 443
       protocol: HTTPS
       quicConfig:
         quicListenerId: ""      # Clear the ID to remove the association.
         quicUpgradeEnabled: false
       requestTimeout: 0
   # Content below is omitted.