Standard Kubernetes Ingress resources handle only basic HTTP routing. MSE Ingress gateways extend this with advanced Layer-7 load balancing, traffic governance, and security capabilities — built on Alibaba Cloud Microservices Engine (MSE) cloud-native gateways and deeply integrated with Container Service for Kubernetes (ACK). They are compatible with NGINX Ingress annotations and designed for large-scale cloud-native deployments.
How MSE Ingress gateways differ from standard Kubernetes Ingress
A Kubernetes Ingress is an API object that exposes cluster services to external traffic and routes requests to backend pods using routing rules. It handles HTTP and HTTPS traffic, but standard Ingress resources cover only basic routing — advanced features such as load balancing algorithms and session affinity require an Ingress controller implementation.
MSE Ingress gateways build on MSE cloud-native gateways to provide a more capable Ingress implementation. Compared to NGINX Ingress gateways:
Compatible with more than 50 NGINX Ingress annotations, covering over 90% of typical NGINX Ingress use cases
Support simultaneous canary releases across multiple service versions
-
Provide flexible traffic governance and comprehensive security protection
Features
For more information about the features of MSE Ingress gateways, see the following topics:
Supported cluster types and prerequisites
MSE Ingress gateways work with ACK managed clusters, ACK Serverless clusters, and Container Compute Service (ACS) clusters.
Before using MSE Ingress gateways, deploy MSE Ingress Controller in your cluster. MSE Ingress Controller manages the lifecycle of MSE cloud-native gateways, synchronizes global parameter settings, and configures Ingress resource listening items — all through MseIngressConfig CustomResourceDefinition (CRD) objects. The MSE cloud-native gateway then watches Ingress resources in the cluster, converts them into traffic governance configurations, and exposes cluster services externally. For more information, see Use MSE Ingress gateways to access services in ACK clusters and ACS clusters.
Kubernetes Ingress resources support only HTTP traffic management, with advanced features implemented through annotations. MSE Ingress gateways are compatible with NGINX Ingress annotations and extend them with additional annotations for traffic governance and security protection. For more information, see Advanced usage of MSE Ingress.
How an MSE Ingress gateway works
Components
-
MSE Ingress Controller:
MSE Ingress Controller is a control plane component — not a network data plane. It manages MSE cloud-native gateways and their configurations without processing any service traffic directly.
Install MSE Ingress Controller in your ACK managed cluster, ACK Serverless cluster, or ACS cluster. Use the MseIngressConfig CRDs it provides to manage cloud-native gateways via annotations and configure Ingress resource listening items for each gateway.
For more information about how to install MSE Ingress Controller, see Manage the MSE Ingress Controller add-on.
-
MSE cloud-native gateways:
MSE Ingress Controller creates MSE cloud-native gateways from the MseIngressConfig CRDs you configure. Each gateway has two planes:
Control plane: Watches Ingress resources, IngressClasses, and services in the cluster. It parses resource configurations and pushes routing rules to the data plane in real time.
Data plane: Handles all external traffic. It applies the routing rules from the control plane to match incoming requests and forward them to the correct backend service.
Traffic flow
The following describes how an MSE Ingress gateway processes traffic, from resource configuration to request routing.
Service: an abstraction over real backend services. One service can represent multiple identical backend instances.
Ingress: a set of reverse proxy rules that route HTTP and HTTPS requests to specific services based on hostname and URL path.
Ingress class: identifies which Ingress controller processes a given Ingress resource. Associate an MseIngressConfig with the Parameter field of an Ingress class to apply the traffic governance rules in the parsed Ingress resource.
MseIngressConfig: a CustomResourceDefinition (CRD) provided by MSE Ingress Controller. Each MseIngressConfig defines the basic configuration for one cloud-native gateway instance.
MSE Ingress Controller: the control plane for managing MSE cloud-native gateways. It watches MseIngressConfig CRDs in the cluster, maintains the gateway lifecycle, and coordinates gateways to enforce the traffic governance rules specified in Ingress resources.
How MSE Ingress Controller and the cloud-native gateway work together:
MSE Ingress Controller detects a new or updated MseIngressConfig CRD and provisions or updates the corresponding cloud-native gateway.
The gateway's control plane connects to the cluster API server and watches for changes to Ingress resources, IngressClasses, and services.
When an Ingress resource changes, the control plane parses the new routing rules and pushes them to the data plane in real time.
When an external request arrives, the data plane matches it against the active routing rules and forwards it to the pod that serves the matched backend service.
The following figure shows how MSE Ingress Controller works.
References
For more information about how to install MSE Ingress Controller, see Manage the MSE Ingress Controller component.
For the release notes for MSE Ingress gateways, see Release notes for MSE Ingress gateways.