ACK supports Nginx, ALB, APIG, and MSE Ingress controllers for Layer 7 traffic routing to cluster services.
Terms
An Ingress is a Kubernetes resource that routes external traffic to internal Service pods through forwarding rules. See Comparison among Nginx Ingresses, ALB Ingresses, and MSE Ingresses.
Nginx Ingress Controller
ACK optimizes the community-maintained Nginx Ingress Controller while maintaining full compatibility and support for all community annotations.
How it works
Deploy an Nginx Ingress Controller in the cluster to parse Ingress forwarding rules. The controller receives requests, matches them against the rules, and forwards them to backend Service pods. The relationship among a Service, an Nginx Ingress, and the Nginx Ingress Controller:
A Service abstracts one or more identical backend services.
An Nginx Ingress defines reverse proxy rules that route HTTP/HTTPS requests to Service pods based on host and URL path.
The Nginx Ingress Controller parses Nginx Ingress rules. When an Ingress changes, the controller updates its forwarding rules and routes incoming requests to the appropriate Service pod.
The Nginx Ingress Controller retrieves Ingress changes from the API Server, generates load balancer configuration files (such as nginx.conf), and reloads the load balancer (for example, nginx -s reload) to apply new routing rules.
The Nginx Ingress Controller can create a Server Load Balancer (SLB) instance through a LoadBalancer-type Service, enabling external access to cluster services based on Nginx Ingress rules.
References for Nginx Ingress
ALB Ingress Controller
The ALB Ingress Controller uses Alibaba Cloud Application Load Balancer (ALB) for Ingress traffic management. Compatible with Nginx Ingress, it supports complex routing, automatic certificate discovery, and HTTP/HTTPS/QUIC protocols for large-scale Layer 7 traffic processing.
How it works
When an Ingress resource changes, the controller detects it via the Kubernetes API server and performs these operations:
Creates an ALB instance.
Configures listeners on the instance.
Creates Ingress rules.
Configures backend server groups.
The three core resources:
Service — Defines a stable network endpoint that Ingresses route traffic to, abstracting an application across replicated pods.
Ingress — Defines reverse proxy rules that route HTTP/HTTPS requests to Services by host name and URL path.
AlbConfig — Configures the underlying ALB instance. The controller generates one AlbConfig per managed ALB instance.
The ALB instance associated with an AlbConfig is fully managed by the Controller. Do not modify it in the ALB console, as this may disrupt Ingress services.
References for ALB Ingress
APIG Ingress Controller
APIG Ingress uses the cloud-native API gateway for traffic management. It is an upgrade to the MSE cloud-native gateway. Compatible with Nginx Ingress and over 50 annotations (covering 90%+ of Nginx Ingress scenarios), it supports simultaneous phased releases, flexible service governance, and comprehensive security protection for large-scale distributed applications.
Components
-
APIG Controller:
-
The APIG Controller manages cloud-native API gateway instances and configurations. It operates in bypass mode and does not process service traffic — gateway instances handle all data-plane traffic.
-
In the cluster, install the APIG Controller component. Use its ApigConfig CRD to declaratively manage gateway instances and configure Ingress listener options.
-
-
Cloud-native API gateway:
The APIG Controller creates the gateway from the ApigConfig resource. The gateway has a control plane and a data plane.
-
Control plane: Listens for Ingress, IngressClass, and Service resources in the associated cluster, parses them, and pushes configurations to the data plane in real time.
-
Data plane: Processes external requests based on control-plane rules and forwards them to backend services.
-
How it works
The APIG Controller listens for ApigConfig resources in the cluster and maintains the lifecycle and cluster association of each gateway instance.
The gateway control plane retrieves Ingress changes from the API server and updates routing rules. When a request arrives, the gateway matches it against Ingress rules and forwards it to the backend Service pods.
The key Kubernetes resources and components are:
-
Service: An abstraction that represents one or more identical backend service instances.
-
Ingress: Reverse proxy rules that route HTTP/HTTPS requests to Services based on host and URL path.
-
IngressClass: Identifies an Ingress controller implementation. Use the Parameter field to associate an ApigConfig that implements traffic rules from Ingress resources.
-
ApigConfig: A CRD provided by the APIG Controller that defines a cloud-native API gateway instance.
-
APIG Controller: Manages gateway instances and configurations by listening for ApigConfig resources and coordinating the gateway to implement Ingress traffic rules.
The following diagram shows how the APIG Controller works.
References for APIG Ingress
MSE Ingress Controller
MSE Ingress uses the MSE cloud-native gateway for traffic management. Compatible with Nginx Ingress and over 50 annotations (covering 90%+ of Nginx Ingress scenarios), it supports simultaneous phased releases, flexible service governance, and comprehensive security protection for large-scale distributed applications.
How it works
Components
MSE Ingress controller:
The MSE Ingress controller is not a network data plane, but is a control plane that manages MSE cloud-native gateways and their configurations. The MSE Ingress controller does not process any service requests. The MSE Ingress controller works as a traffic bypass to manage MSE cloud-native gateways that process service traffic.
You must install the MSE Ingress Controller component in your ACK cluster, use the MseIngressConfig CRDs provided by this component to manage cloud-native gateways based on annotations, and configure Ingress resource listening items for the gateways.
For more information about how to install the MSE Ingress controller component, see Manage the MSE Ingress Controller add-on.
MSE cloud-native gateways: MSE cloud-native gateways are created based on the MseIngressConfig CRDs that you configured. An MSE cloud-native gateway consists of a control plane and a data plane.
Control plane: monitors resources such as Ingresses, Ingress classes, and Services in an associated ACK cluster. After the resources are parsed, the parsed resource configurations are sent to the gateway data plane in real time.
Data plane: implements traffic governance. The data plane processes external requests based on the governance rules that are sent from the control plane, and routes the requests to your destination backend Service.
Workflow
The MSE Ingress controller monitors the resource that is defined by an MseIngressConfig CRD in an ACK cluster and dynamically maintains the lifecycle of the cloud-native gateway that corresponds to the resource and the association between the gateway and ACK cluster in real time.
The control plane of the cloud-native gateway obtains the changes of Ingress resources by using the API server of the associated ACK cluster, and dynamically updates the routing rules of the gateway. After the cloud-native gateway receives a request, the gateway matches the request with an Ingress routing rule and routes the request to the pod that corresponds to the backend Service based on the matched routing rule.
In a Kubernetes cluster, Services, Ingresses, Ingress classes, MseIngressConfigs, and MSE Ingress controller work in the following process:
Service: an abstraction of real backend services. One service can represent multiple identical backend services.
Ingress: a set of reverse proxy rules. An Ingress specifies the service to which HTTP requests or HTTPS requests are routed. For example, an Ingress routes requests to different Services based on the hostnames and URLs in the requests.
Ingress class: a description of the Ingress processor. An Ingress class is used to declare the implementation of an Ingress processor in a Kubernetes cluster. The Ingress resources that are associated with the Ingress class are parsed by the Ingress processor. You must associate an MseIngressConfig with the Parameter field of the Ingress class to implement the traffic management rule that is specified in the parsed Ingress resource description.
MseIngressConfig: a CRD that is provided by MSE Ingress Controller. An MseIngressConfig CRD provides basic information about a cloud-native gateway.
MSE Ingress Controller: a control plane that manages MSE cloud-native gateways and their configurations. MSE Ingress Controller is not a network data plane. The MSE Ingress controller is used to monitor Ingress resources defined by MseIngressConfig CRDs in a cluster and coordinate MSE cloud-native gateways to implement the traffic management rule that is specified in the parsed Ingress resource description.
The following figure shows how the MSE Ingress controller works.
