Configure an MSE cloud-native gateway as an egress gateway - Microservices Engine

An egress gateway is an edge gateway that connects an internal network to an external network. It controls network traffic and enables remote access and communication. You can use an MSE cloud-native gateway as an egress gateway to provide a stable, efficient, and secure network egress service for your Container Service for Kubernetes (ACK) cluster. This allows you to manage egress traffic and implement security controls.

Benefits of an MSE cloud-native gateway

An MSE cloud-native gateway provides an independently deployed, managed gateway. This isolation from the ACK cluster ensures higher stability.
An MSE cloud-native gateway provides Layer 7 HTTP governance features, such as IP allowlists and denylists, traffic throttling, load balancing, TLS offloading, traffic mirroring, and header control.
You do not need to enable public network access for every pod in the ACK cluster. Instead, you only enable public access for the MSE cloud-native gateway by configuring SNAT for its vSwitch. This reduces the attack surface and enhances security.

Deployment architecture

Procedure

Step 1: Install the MSE Ingress Controller

Install the MSE Ingress Controller in an existing Container Service for Kubernetes (ACK) or ACK Serverless cluster, or install it when you create a new cluster. For more information, see Manage the MSE Ingress Controller component.

Step 2: Create an MseIngressConfig resource

MseIngressConfig is a Custom Resource Definition (CRD) provided by the MSE Ingress Controller. You can create a MseIngressConfig resource to create or associate an MSE-managed gateway instance. For more information, see Create an MSE cloud-native gateway instance.

When you create the gateway, you only need to create an internal-facing Classic Load Balancer (CLB). The following is a sample configuration:

apiVersion: mse.alibabacloud.com/v1alpha1
kind: MseIngressConfig
metadata:
  name: egress-gateway
spec:
  name: egress-gateway
  common:
    instance:
      spec: 2c4g
      replicas: 3
    network:
      vSwitches:
        - "vsw-xxxx" # The ID of the vSwitch to which the gateway is bound.
      privateSLBSpec: slb.s2.small

Note

If you did not select Configure SNAT for VPC when you created the ACK or ACK Serverless cluster, the cluster cannot access the Internet. You must configure SNAT for the gateway separately to enable public access.

Public network access requires an SNAT entry in a NAT gateway. To create a NAT gateway, see Use the SNAT feature of a public NAT gateway to access the Internet. In the linked document, follow the instructions in Step 3: Create an SNAT entry. For the SNAT entry, select vSwitch and specify the vSwitch ID from your MseIngressConfig.

Step 3: Create an ExternalName service

A Kubernetes ExternalName service maps an internal service to a DNS name. For example, to access the Alibaba Cloud MSE product page from within your Kubernetes cluster, you can use the following configuration:

apiVersion: v1
kind: Service
metadata:
  name: aliyun-svc-external
  namespace: default
spec:
  externalName: www.aliyun.com
  ports:
    - name: port1
      port: 80
      protocol: TCP
      targetPort: 80
    - name: port2
      port: 443
      protocol: TCP
      targetPort: 443
  type: ExternalName

Step 4: Configure routing for the ExternalName service

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: mse-ingress
  namespace: default
spec:
  ingressClassName: mse
  rules:
    - host: www.aliyun.com  # The target domain name.
      http:
        paths:
          - backend:
              service:
                name: aliyun-svc-external  # The backend ExternalName service.
                port:
                  number: 80
            path: /product/aliware/mse  # The access path for the backend service.
            pathType: Prefix

Save the preceding configuration as mse-ingress.yaml and run kubectl apply -f mse-ingress.yaml. Then, run kubectl get ingress mse-ingress -o yaml to view the Ingress resource and obtain the CLB address of the MSE cloud-native gateway. The following provides a sample output:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS  # Required because Alibaba Cloud services enforce HTTPS. The gateway must use HTTPS to route to the backend service.
  name: mse-ingress
  namespace: default
spec:
  ingressClassName: mse
  rules:
    - host: www.aliyun.com
      http:
        paths:
          - backend:
              service:
                name: aliyun-svc-external
                port:
                  number: 443
            path: /product/aliware/mse  
            pathType: Prefix
status:
  loadBalancer:
    ingress:
      - ip: xx.xx.xx.xx  # Replace this with the CLB address of the MSE cloud-native gateway.

Step 5: Verify access to the external service

curl http://www.aliyun.com/product/aliware/mse --resolve  www.aliyun.com:80:xx.xx.xx.xx