Migrate NGINX Ingress to ALB Ingress

Migration process

Resolve a domain name to both the NGINX Ingress and ALB Ingress, then gradually adjust DNS weights to shift traffic seamlessly. The following diagram shows the process. The Migration example below provides detailed steps.

DNS-based traffic shifting is one approach to zero-downtime migration. This process is for reference only.

Migration example

The following example walks through the migration with specific operations.

A company runs an NGINX Ingress controller in its cluster. The controller's Internet-facing LoadBalancer-type Service automatically provisions an Internet-facing CLB instance. DNS resolves www.example.net to the CLB, which forwards requests to backend pods.

Step 1: Configure the ALB Ingress

The NGINX Ingress can no longer meet performance requirements and incurs high O&M costs. The company uses the migration tool to convert the NGINX Ingress configuration to ALB Ingress and adds the ALB Ingress to DNS with a lower weight.

Step 2: Gradually shift traffic to ALB Ingress

After verifying the ALB Ingress works as expected, increase the DNS weight for the ALB Ingress to route more traffic through it.

Step 3: Delete NGINX Ingress resources

After all traffic is migrated to ALB Ingress, delete the NGINX Ingress DNS entries, remove the NGINX Ingress resources, and uninstall the NGINX Ingress controller add-on.

Prerequisites

A kubectl client is connected to the ACK cluster. For more information, see Connect to an ACK cluster using kubectl.

Step 1: Configure the ALB Ingress

1. Log on to the Container Service for Kubernetes (ACK) console and install the ALB Ingress controller add-on in the cluster where you want to perform the migration.Log on to the Container Compute Service console and install the ALB Ingress controller add-on in the cluster where you want to perform the migration. The migration tool automatically converts AlbConfig, IngressClass, and Ingress resources. Therefore, when you install the add-on, select None for ALB Instance.

   Important

   To access services through an ALB Ingress in an ACK dedicated cluster, grant permissions to the ALB Ingress controller before deploying services. Grant permissions to the ALB Ingress controller in an ACK dedicated cluster.

2. Create a file named ingress2albconfig.yaml with the following content.

   apiVersion: batch/v1
   kind: Job
   metadata:
     name: ingress2albconfig
     namespace: default
   spec:
     template:
       spec:
         containers:
         - name: ingress2albconfig
           image: registry-cn-hangzhou.ack.aliyuncs.com/acs/ingress2albconfig:0.0.2
           command: ["/bin/ingress2albconfig", "print", "-A"]
         restartPolicy: Never
         serviceAccount: ingress2albconfig
         serviceAccountName: ingress2albconfig
     backoffLimit: 4
   ---
   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: system:ingress2albconfig
   rules:
   - apiGroups:
     - networking.k8s.io
     resources:
     - ingresses
     - ingressclasses
     verbs:
     - get
     - list
     - watch
     - update
     - create
     - patch
   ---
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: ingress2albconfig
     namespace: default
   ---
   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: system:ingress2albconfig
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: system:ingress2albconfig
   subjects:
     - kind: ServiceAccount
       name: ingress2albconfig
       namespace: default

3. Run the following command to start the Job. The Job converts existing NGINX Ingress configurations into AlbConfig, IngressClass, Ingress, and other resources and outputs the results to the pod logs.

   kubectl apply -f ingress2albconfig.yaml

   Expected output:

   job.batch/ingress2albconfig created
   clusterrole.rbac.authorization.k8s.io/system:ingress2albconfig created
   serviceaccount/ingress2albconfig created
   clusterrolebinding.rbac.authorization.k8s.io/system:ingress2albconfig created

4. View the pod that belongs to the Job.

   kubectl get pod -l job-name=ingress2albconfig

   Expected output:

   NAME                READY   STATUS      RESTARTS   AGE
   ingress2albconfig-vw***   0/1     Completed   0          16m

5. View the pod logs.

   kubectl logs ingress2albconfig-vw*** # Replace this with the pod name from the previous step.

   Expected output. Deploy these resources to the cluster to configure the ALB Ingress.

   apiVersion: alibabacloud.com/v1
   kind: AlbConfig
   metadata:
     name: from-nginx
   spec:
     config:
       accessLogConfig: {}
       edition: Standard
       name: from-nginx
       tags:
       - key: converted/ingress2albconfig
         value: "true"
       zoneMappings:
       - vSwitchId: vsw-xxx # Replace this with the ID of a vSwitch in your VPC.
       - vSwitchId: vsw-xxx # Replace this with the ID of a vSwitch in your VPC.
     listeners:
     - port: 80
       protocol: HTTP
   ---
   apiVersion: networking.k8s.io/v1
   kind: IngressClass
   metadata:
     name: from-nginx
   spec:
     controller: ingress.k8s.alibabacloud/alb
     parameters:
       apiGroup: alibabacloud.com
       kind: AlbConfig
       name: from-nginx
   ---
   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     annotations:
       alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80}]'
     name: from-ingress1
     namespace: default
   spec:
     ingressClassName: from-nginx
     rules:
     - http:
         paths:
         - backend:
             service:
               name: nginx-svc-g1msr
               port:
                 number: 80
           path: /
           pathType: Prefix
   status:
     loadBalancer: {}

Step 2: Gradually shift traffic to ALB Ingress

Step 3: Delete NGINX Ingress resources

After all persistent connections to the NGINX Ingress close and no new traffic reaches it, monitor the system for a period appropriate to your business before releasing the redundant resources.

1. Delete the NGINX Ingress-related DNS entries from the Alibaba Cloud DNS console.

2. Uninstall the NGINX Ingress controller add-on.

   1. Log on to the ACK console.

   2. On the Clusters page, click the name of the target cluster. In the navigation pane on the left, choose Network > Ingresses.

   3. Find the NGINX Ingress. In the Actions column, choose > Delete. In the dialog box that appears, click Confirm Deletion.

   4. In the navigation pane on the left, choose Add-ons. Click the Networking tab. On the NGINX Ingress controller card, click Uninstall.

   5. In the dialog box that appears, click OK.

      Uninstalling the add-on automatically releases the CLB instance used by the NGINX Ingress controller, which will no longer incur fees.

3. Log on to the Container Compute Service console. In the navigation pane on the left, click Applications > Helm and uninstall the NGINX Ingress controller add-on.

Related documents

• Configure an ALB instance by using AlbConfig

• Configure an HTTPS certificate for encrypted communication

• ALB Ingress annotations