Container Service for Kubernetes:Use preStop hooks to prevent 502/504 errors during ALB Ingress rolling updates

Prerequisites

Before you begin, make sure you have:

• An ACK managed cluster or ACK dedicated cluster (discontinued) running Kubernetes 1.18 or later. To upgrade, see Manually upgrade ACK clusters.

• The ALB Ingress controller is installed in the cluster.

To use an ALB Ingress with an ACK dedicated cluster, authorize the cluster for the ALB Ingress controller first.

How it works

Pod lifecycle

A pod contains two types of containers:

• Init container: Runs before the main container for initialization.

• Main container: Runs the application. postStart runs after startup, liveness and readiness checks run during the container's lifetime, and preStop runs before termination.

The following figure shows the pod lifecycle.

Step 1: Deploy the application with a preStop hook

1. Create tea-service.yaml with the following content. The lifecycle.preStop field configures the hook.

   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: tea
   spec:
     replicas: 3
     selector:
       matchLabels:
         app: tea
     template:
       metadata:
         labels:
           app: tea
       spec:
         containers:
         - name: tea
           image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
           ports:
           - containerPort: 80
           lifecycle:
             preStop:          # Delay SIGTERM by 10 seconds to allow the ALB Ingress controller
               exec:           # to finish deregistering the pod from the backend server group.
                 command:
                 - /bin/sh
                 - -c
                 - "sleep 10"
         terminationGracePeriodSeconds: 45   # Must exceed preStop duration + program shutdown time.
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: tea-svc
   spec:
     ports:
     - port: 80
       targetPort: 80
       protocol: TCP
     selector:
       app: tea
     type: NodePort

2. Deploy the Deployment and Service.

   kubectl apply -f tea-service.yaml

3. Create tea-ingress.yaml with the following content.

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: tea-ingress
   spec:
     ingressClassName: alb
     rules:
     - host: demo.ingress.top
       http:
         paths:
         - path: /
           pathType: Prefix
           backend:
             service:
               name: tea-svc
               port:
                 number: 80

4. Create the Ingress.

   kubectl apply -f tea-ingress.yaml

5. Get the ALB address for the Ingress.

   kubectl get ingress

   Expected output:

   NAME          CLASS   HOSTS              ADDRESS                                              PORTS   AGE
   tea-ingress   alb     demo.ingress.top   alb-110zvs5nhsvfv*****.cn-chengdu.alb.aliyuncs.com   80      7m5s

   Note the ADDRESS value for the next step.

Step 2: Verify that the preStop hook prevents service interruptions

1. Create test.sh with the following content. The script sends one request per second and logs each HTTP status code.

   #!/bin/bash
   HOST="demo.ingress.top"
   DNS="alb-110zvs5nhsvfv*****.cn-chengdu.alb.aliyuncs.com"  # Replace with your ADDRESS value.
   printf "Response Code|| TIME \n" >> log.txt
   
   while true; do
     RESPONSE=$(curl -H Host:$HOST -s -o /dev/null -w "%{http_code}" -m 1 http://$DNS/)
     TIMESTAMP=$(date +%Y-%m-%d_%H:%M:%S)
     echo "$TIMESTAMP - $RESPONSE" >> log.txt
     sleep 1
   done

2. Run the script.

   bash test.sh

3. Trigger a rolling restart.

   kubectl rollout restart deploy tea

4. Watch the rollout progress. The following screenshots show the expected pod states during each phase of the update.

   

   

   

   

5. Check the test log. All requests should return 200, confirming zero service interruptions.

   cat log.txt

   Expected output:

   

Next steps

• For advanced routing—such as HTTP-to-HTTPS redirects and canary releases—see Advanced ALB Ingress configurations.

• To ensure pods pass readiness checks before receiving traffic during rolling updates, see Use readiness gates to seamlessly launch pods that are associated with ALB Ingresses during rolling updates.

• If you run into issues, see ALB Ingress FAQ and ALB Ingress controller troubleshooting.