ALB Ingress guide

In addition to Container Service for Kubernetes (ACK) and ACK Serverless, ALB Ingress works with Enterprise Distributed Application Service (EDAS), Serverless App Engine (SAE), and self-managed Kubernetes clusters to support diverse business requirements. This topic describes the basic and advanced features of ALB Ingress and shows how to use it with other Alibaba Cloud services.

Basic features

An AlbConfig is a Custom Resource Definition (CRD) provided by the ALB Ingress controller for configuring Application Load Balancer (ALB) instances and listeners. The following table describes how to install and uninstall the ALB Ingress controller, create and modify AlbConfigs, and enable Simple Log Service in ACK and ACK Serverless clusters.

Object	Feature	Description	ACK documentation	ACK Serverless documentation
ALB Ingress controller	Manage the ALB Ingress controller component	ACK provides a managed ALB Ingress controller based on ALB. You can install the ALB Ingress controller when you create a cluster or on the Add-ons page.	Manage the ALB Ingress controller component	Manage the ALB Ingress controller component
Instance management	Create an AlbConfig	An AlbConfig is a Custom Resource Definition (CRD) provided by the ALB Ingress controller that you use to configure an ALB instance and its listeners. Each AlbConfig corresponds to one ALB instance, so you must create multiple AlbConfigs to use multiple ALB instances.	Create an AlbConfig	Create an AlbConfig
	Associate an Ingress	An AlbConfig is associated with an Ingress by using a standard Kubernetes IngressClass resource. You must first create an IngressClass and then associate it with the AlbConfig.	Create an IngressClass and associate it with an AlbConfig	Use an IngressClass to associate an AlbConfig with an Ingress
	Modify an AlbConfig	You can modify AlbConfig properties, such as the name and vSwitch settings. Changes take effect immediately after you save them.	Configure an ALB instance by using an AlbConfig Configure an ALB instance by using an AlbConfig	Configure an ALB instance by using an AlbConfig Configure an ALB instance by using an AlbConfig
	Enable access logging with Simple Log Service	If you want ALB Ingress to collect access logs, you must specify `logProject` and `logStore` in the AlbConfig. Note You must manually create a Simple Log Service Project. For more information, see Manage projects. The Logstore name must start with `alb_`. If the specified Logstore does not exist, the system automatically creates it.	Enable access logging with Simple Log Service	Enable access logging with Simple Log Service
	Reuse an existing ALB instance	To reuse an existing ALB instance, specify its ID when creating the AlbConfig.	Reuse an existing ALB instance	Reuse an existing ALB instance
	Use multiple ALB instances	When you need to use multiple ALB instances, you can specify different IngressClasses in the Ingress by using `spec.ingressClassName`.	Create and use multiple ALB instances	Create and use multiple ALB instances
	Delete an ALB instance	Each ALB instance corresponds to one AlbConfig. To delete an ALB instance, delete its associated AlbConfig. Before deleting an AlbConfig, you must first delete all Ingresses associated with it.	Delete an AlbConfig	Delete an AlbConfig
Listener management	Specify an HTTPS certificate	You can specify an Application Load Balancer (ALB) certificate by using an ALBConfig and configuring its `listeners` to specify the certificate ID for HTTPS.	Configure an HTTPS certificate to enable encrypted communication	Configure an HTTPS certificate to enable encrypted communication
Listener management	Support for TLS security policies	When configuring an HTTPS listener in an AlbConfig, you can specify a custom or system default TLS security policy. For more information, see TLS security policies.	Specify a TLS security policy	Specify a TLS security policy

Advanced features

In an ACK cluster, ALB Ingress manages external access to cluster Services, providing Layer 7 load balancing capabilities. The following table describes how to use an ALB Ingress to forward requests from different domain names or URL paths to different backend server groups, redirect HTTP requests to HTTPS, and implement canary releases.

JSON values in Ingress annotations must use standard English punctuation. Mixing Chinese and English punctuation causes an invalid character reconciliation error. Edit these values using an English input method.

ALB Ingress integrations

Alibaba Cloud integrations

Alibaba Cloud product	Feature	Description	Documentation
WAF	Enable WAF protection for ALB Ingress	Web Application Firewall (WAF) protects your applications from common web attacks. When WAF protection is enabled for an ALB Ingress, all traffic to the ALB instance is protected.	Enable WAF protection for ALB Ingress
EDAS	Create an application route (ALB Ingress)	Enterprise Distributed Application Service (EDAS) uses ALB Ingress for application routing. Based on Alibaba Cloud Application Load Balancer (ALB), ALB Ingress provides advanced traffic management, is compatible with Nginx Ingress, and handles complex business routing and automatic certificate discovery.	Create an application route (ALB Ingress)
SAE	Implement end-to-end canary releases based on Ingress gateways	You can use an ALB Ingress gateway to implement end-to-end traffic control for your SAE applications without modifying any business code.	Best practices for ALB gateway routing Five-minute guide to ALB Ingress gateway routing
ASM	Integrate with ALB by using an Ingress.	You can integrate Alibaba Cloud Service Mesh (ASM) with Application Load Balancer (ALB) by using an Ingress. This allows ALB users to leverage ASM's capabilities.	Integrate ASM with an Application Load Balancer instance
HPA	Integrate with ALB by using an Ingress.	You can integrate Horizontal Pod Autoscaler (HPA) with Application Load Balancer (ALB) by using an Ingress to enable automatic, QPS-based application autoscaling.	Use HPA to implement application autoscaling based on QPS data
Knative	Access services through ALB in ACK or ACK Serverless clusters where the Knative component is installed.	Knative is a Kubernetes-based serverless framework. You can use Knative to configure ALB service discovery and implement canary releases based on headers and cookies.	Use an ALB gateway
ACK One	Create a multi-cluster ALB gateway by using an Ingress.	Distributed Cloud Container Platform for Kubernetes (ACK One) is an enterprise-level cloud-native platform from Alibaba Cloud for scenarios such as hybrid clouds, multi-cluster management, distributed computing, and disaster recovery. The ACK One ALB multi-cluster gateway, which is the multi-cluster mode of ALB Ingress, allows you to implement active-active zone-disaster recovery, geo-disaster recovery, multi-cluster load balancing, and header-based routing to specific clusters.	ACK One ALB multi-cluster gateway Implement zone-disaster recovery by using an ACK One ALB multi-cluster gateway Implement hybrid cloud disaster recovery by using an ACK One ALB multi-cluster gateway

Open source integrations

Open source product	Feature	Description	Documentation
Self-managed Kubernetes on the cloud	Use ALB in a self-managed Kubernetes cluster by using an Ingress.	In a Kubernetes cluster built on Elastic Compute Service (ECS) resources, you can use an Ingress to orchestrate ALB routing for automatic service discovery and in-cluster load balancing.	User guide for ALB Ingress on self-managed Kubernetes clusters