Overview of ALB Extensible Edition
To meet the unified ingress requirements for both traditional and AI applications, Alibaba Cloud offers the ALB Extensible Edition. Built on flexible Service Extensions, this edition provides core traffic management features like identity authentication and content-based routing. It also adds AI-native features, including multi-model proxy, load-aware routing, and token-based rate limiting, creating an integrated, intelligent traffic gateway for both AI and traditional applications.
Benefits
Application-layer elasticity: ALB Extensible Edition operates at the application layer, providing domain names and VIPs with multi-level distribution to handle large-scale requests. It supports scaling out application service capabilities through traffic distribution, eliminating single points of failure, and improving system availability. It also allows you to customize availability zone combinations and elastically scale across zones to avoid resource bottlenecks in a single availability zone.
Advanced content-based routing: ALB Extensible Edition identifies specific business traffic based on various conditions such as path, HTTP header, and forwards the traffic to different backend servers. It also supports advanced actions such as redirects, rewrites, and custom HTTP headers.
Application-layer content awareness: ALB Extensible Edition supports deep parsing and can dynamically route traffic to different backend services based on the content of the request body. It provides "L7+" proxy capabilities on top of the original Layer 7 proxy, making it widely applicable to AI application scenarios.
Flexible Service Extensions: ALB supports Service Extensions, which let you use plug-ins and external service calls to meet custom business requirements in scenarios such as AI applications.
Security and reliability: ALB Extensible Edition natively supports security features such as Credential Management, built-in DDoS protection, and integration with WAF. It also provides end-to-end HTTPS encryption, supports TLS security policies and encryption protocols like TLS 1.3, and is suitable for encryption-sensitive services, meeting the requirements of a Zero Trust security architecture.
SSE streaming: ALB Extensible Edition supports SSE streaming. In large language model (LLM) AI applications, you can use SSE to return generated inference results in real time, improving user experience.
Flexible billing: ALB Extensible Edition provides public network capabilities through EIPs and Internet Shared Bandwidth, enabling flexible billing for public network usage. It also uses a pricing model based on Load Balancer Capacity Units (LCUs), which is ideal for workloads with fluctuating traffic peaks.
Use cases
Application traffic gateway: Suitable for traditional web and AI applications, providing features such as traffic distribution, authentication, and rate limiting.
Workloads for traditional and AI applications: Use model-aware routing to direct traffic based on specific model requirements, improve GPU utilization, and deliver low-latency inference.
Unified multi-model proxy: Supports model adaptation, intelligent scheduling, and dynamic failover. It integrates fine-grained identity authentication to build a secure, elastic, and highly reliable AI infrastructure.
High-availability deployment for hybrid and multi-cloud applications: Simplifies hybrid connections and ensures security. As the core of a cross-cloud network, it provides high-performance application delivery and security for data centers, branch offices, and multi-cloud resources.
Container Ingress gateway: Routes external HTTP(S) requests to container services within a cluster. It supports blue-green deployments, A/B testing, TLS termination, and content-based routing.
High-performance secure application delivery: Provides auto-scaling, high-performance load balancing and integrates with security products such as WAF, DDoS protection, and Cloud Firewall to protect application delivery.
Instance performance metrics
An ALB instance allocates three IP addresses from each specified vSwitch: one VIP for client-facing services and two local IP addresses for backend communication and health checks.
To ensure all elastic capabilities of ALB are available, we recommend that you reserve at least eight IP addresses in each vSwitch where you deploy an ALB instance.
Performance metric | Maximum auto-scaled performance |
Maximum queries per second (QPS) | 500,000 |
Maximum new connections per second (CPS) | 200,000 |
Maximum concurrent connections | 5,000,000 |
Maximum private bandwidth | 25 Gbps |
The default public bandwidth for a dual-zone ALB instance is 400 Mbps. The actual public bandwidth is determined by the total bandwidth of all EIPs associated with the instance.
-
Within a single region, the total peak bandwidth of all pay-by-data-transfer EIPs under a single Alibaba Cloud account cannot exceed 5 Gbit/s. Bandwidth limits: Pay-as-you-go.
-
To increase bandwidth, purchase a Bandwidth Package. Create and manage a Bandwidth Package.
Components
Concept | Description |
Instances | An instance provides Layer 7 load balancing by distributing traffic to different backend servers to scale the service throughput of your application system. A single instance can handle up to 1,000,000 QPS. |
Listener | A listener is the smallest service unit of an ALB instance. You must configure a protocol and port for a listener to specify the type of traffic that the ALB instance processes, such as HTTP traffic on port 80. Each ALB instance must have at least one listener to process and forward traffic. By default, you can add up to 50 listeners to each ALB instance to handle different business traffic. |
Forwarding Rules | A forwarding rule determines how an ALB instance routes requests to backend servers in one or more server groups. ALB Extensible Edition supports various routing rules based on conditions such as domain name, path, and HTTP header. When associated with Service Extensions, it supports deep parsing of request bodies to enable application-layer content-aware scheduling. |
Service Extensions | ALB Service Extensions allow you to inject custom logic into the data forwarding path. Using a plug-in mechanism and external service callouts (Callouts), you can execute business logic such as dynamic routing, authentication and authorization, content rewriting, and AI context awareness at key nodes of request processing. ALB Extensible Edition provides a built-in component library that covers common scenarios, eliminating the need to modify application code or deploy an additional proxy layer. |
Server Groups | A server group is a logical group that contains multiple backend servers to process requests distributed by an ALB instance. In ALB, a server group is independent of the ALB instance, and you can attach the same server group to different ALB instances. The server groups of ALB Extensible Edition support server (ECS, ECI, and elastic network interface), IP, Function Compute, DNS domain name, and AI service backend types. |
Health Check | ALB uses health checks to determine the service availability of backend servers. ALB detects unhealthy servers in a server group and avoids distributing traffic to them. ALB supports various health check configurations, such as protocol, port, and various health check thresholds. ALB also provides health check templates that can be quickly applied to different server groups. |
Credential Management | The Credential Management feature of ALB Extensible Edition supports the centralized creation and management of outbound identity credentials, which are encrypted and stored by using KMS. When adding a backend service, you can directly reference the created credentials. ALB automatically includes these credentials when it forwards requests to complete identity authentication. |
Instance types
Alibaba Cloud provides Internet-facing and internal-facing ALB instances. You can configure an Internet-facing or internal-facing ALB instance based on your business scenario. The system determines whether to use Internet Shared Bandwidth and EIPs based on your selection.
Concept | Description |
VIP (virtual IP address) | A private IP address in a Virtual Private Cloud (VPC) that ALB uses to distribute traffic. |
EIP | EIPs are required only when you create an Internet-facing ALB instance. You do not need to configure EIPs when you create an internal-facing ALB instance. An EIP is the IP address that an ALB instance uses to provide services over the internet. An Internet-facing ALB instance can have multiple EIPs. For high availability, an Internet-facing ALB instance must have at least two EIPs in different availability zones. |
Internet Shared Bandwidth | Internet Shared Bandwidth provides region-level bandwidth sharing and reuse. You can add EIPs in the same region to an Internet Shared Bandwidth instance to reuse bandwidth and reduce public bandwidth costs. |
Zone Name | A domain name that can be resolved over the internet or a private network to the EIP or VIP of an ALB instance. Map your domain name to the domain name of the ALB instance by adding a CNAME record. For more information, see Configure a CNAME record for an ALB instance. |
Enable ALB Extensible Edition
Apply for access: Submit an ALB Extensible Edition privilege request. The service becomes available once your application is approved.
Get started: Log on to the Application Load Balancer console to create and configure an ALB Extensible Edition instance.
ALB Extensible Edition is in public preview. To learn more and apply for access, see the announcement.
Usage notes
ALB Extensible Edition instances do not support client access from the 33.0.0.0/8 and 22.0.0.0/16 IP address ranges.