Documentation
Home Page Server Load Balancer Application Load Balancer Cloud Native Applications Use ALB Ingress on a self-managed K8s cluster

Use ALB Ingress on a self-managed K8s cluster

Updated at:
Copy as MD
Product

This topic describes how to use an ALB ingress in a self-managed Kubernetes cluster running on Alibaba Cloud to manage traffic with Application Load Balancer (ALB).

Example scenario

This topic uses the scenario shown in the following figure, where a self-managed Kubernetes cluster running on Alibaba Cloud uses an ALB ingress to route requests.

You can deploy the alb-ingress-controller and create ingress and service resources in your self-managed Kubernetes cluster. The alb-ingress-controller synchronizes ingress configurations to an ALB instance as forwarding rules. It also monitors the cluster's API Server for changes to the ingresses and synchronizes these updates with the ALB instance. The ALB instance then dynamically routes traffic to the corresponding pods in the cluster. For more information, see ALB ingress management.

ALB Ingress场景示例

Usage notes

  • If you use an overlay network plug-in, such as Flannel, the backend service for the ALB ingress must be a NodePort or LoadBalancer service.

  • The names of AlbConfig, Namespace, Ingress, and Service resources cannot start with aliyun.

Prerequisites

  • You have a self-managed Kubernetes cluster (v1.20 or later) running on Alibaba Cloud. You can connect to the cluster by using kubectl. For information about how to download and install kubectl, see Install and set up kubectl.

  • You have configured SNAT to enable internet access for the self-managed cluster. For more information, see Use the SNAT feature of an Internet NAT gateway to access the Internet.

  • When you use a controller image for your self-managed cluster, consider the following:

    • If you use a private image, you can compile and upload it by following the instructions in Deploy the controller from source code.

    • For clusters with a generic x86 architecture, you can use the public image provided by Alibaba Cloud for testing.

Procedure

配置步骤

The following steps involve modifying several files. The table below outlines the purpose of each.

Step

File name

Purpose

Step 1: Deploy the alb-ingress-controller

load-balancer-controller.yaml

Modified from a template

To deploy the alb-ingress-controller

Step 2: Create AlbConfig and IngressClass resources

alb.yaml

Created and modified

To create AlbConfig and IngressClass resources, which automatically creates an ALB instance

Step 3: Deploy a test application

test-service.yaml

Created and modified

To deploy a test service

Step 4: Create an ingress

test-ingress.yaml

Created and modified

To create an ingress

Step 1: Deploy the alb-ingress-controller

Note

Pulling the deployment image may fail due to ISP network issues. To avoid this, you can use a private image. Compile and upload it by following the instructions in Deploy the controller from source code.

In this topic, the alb-ingress-controller starts in InCluster mode. After you configure permissions to watch service, endpoint, and node resources, you can use the load-balancer-controller.yaml file to deploy the alb-ingress-controller. The required ServiceAccount, Deployment, and ConfigMap are pre-configured. You only need to modify them to fit your environment.

  1. Modify the load-balancer-controller.yaml file to change the Deployment's image to an accessible image address.

    The load-balancer-controller.yaml file is used to deploy the alb-ingress-controller.

    Before modification:

    image: ${path/to/your/image/registry}

    After modification:

    image: alibabacloudslb/alibaba-load-balancer-controller:v1.2.0  # An x86-compiled image.

  2. Modify the load-balancer-controller.yaml file to configure the AccessKey ID and AccessKey secret in the ConfigMap.

    Note

    Log on to the RAM console with the Alibaba Cloud account that you want to use to create the ALB instance. Then, view the AccessKey ID and AccessKey secret on the AccessKey page.

    apiVersion: v1
kind: ConfigMap
metadata:
  name: load-balancer-config
  namespace: kube-system
data:
  cloud-config.conf: |-
       {
           "Global": {
               "AccessKeyID": "<YOUR_ACCESS_KEY_ID>", # Base64 encoding is required.
               "AccessKeySecret": "<YOUR_ACCESS_KEY_SECRET>" # Base64 encoding is required.
           }
       }

  3. Connect to the cluster by using kubectl and run the following command to apply the modified load-balancer-controller.yaml file.

    kubectl apply -f load-balancer-controller.yaml

    Expected output:

    clusterrole.rbac.authorization.k8s.io/system:load-balancer-controller created
serviceaccount/load-balancer-controller created
clusterrolebinding.rbac.authorization.k8s.io/system:load-controller-manager created
configmap/load-balancer-config created
deployment.apps/load-balancer-controller created

  4. Run the following command to verify the deployment of the alb-ingress-controller.

    kubectl -n kube-system get all | grep load-balancer

    The following output shows that the pod is in the Running state, which indicates a successful deployment.

    [root@iZ2ze9xxx uoZ test]# kubectl -n kube-system get all | grep load-balancer
pod/load-balancer-controller-67985dd48d-qtgl8       1/1     Running   0          61d
deployment.apps/load-balancer-controller   1/1   1            1           62d
replicaset.apps/load-balancer-controller-67985dd48d   1         1         1       62d

Step 2: Create AlbConfig and IngressClass resources

After creating the AlbConfig and IngressClass resources, an ALB instance is automatically created.

  1. Create a file named alb.yaml and copy the following content into it.

    The alb.yaml file is used to create AlbConfig and IngressClass resources.

    apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: alb-demo
spec:
  config:
    name: alb-test             # The name of the ALB instance.
    addressType: Internet      # Use 'Internet' for public-facing or 'Intranet' for private.
    zoneMappings:
    - vSwitchId: vsw-wz9e2usil7e5an1xi****    # Specify vSwitch IDs in at least two zones.
    - vSwitchId: vsw-wz92lvykqj1siwvif****
  listeners:
    - port: 80
      protocol: HTTP
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: alb
spec:
  controller: ingress.k8s.alibabacloud/alb
  parameters:
    apiGroup: alibabacloud.com
    kind: AlbConfig
    name: alb-demo   # The referenced AlbConfig resource.
    Note

    Note the following parameters:

    • albconfig.spec.config.addressType: The network type of the instance. Valid values:

      • Internet (default): Creates a public-facing instance. A public IP and a private IP are assigned to each zone. Public-facing ALB instances use an elastic IP address (EIP) to provide services over the Internet. You are charged for instance fees and data transfer fees for the EIP.

        • The EIP provides public internet access to the ALB instance.

        • The private IP allows access to the ALB instance from ECS instances within the same VPC.

      • Intranet: Creates a private instance. A private IP is assigned to each zone. The ALB instance is accessible only from within the Alibaba Cloud network and cannot be reached from the Internet.

    • spec.config.zoneMappings: Specifies the vSwitch IDs for the ALB Ingress. You must specify at least two vSwitch IDs from different zones. The specified vSwitches must be in zones that are supported by the current ALB instance. For more information about the regions and zones supported by ALB, see Supported regions and zones.

  2. Connect to the cluster by using kubectl and run the following command to apply the alb.yaml file.

    kubectl apply -f alb.yaml

    Expected output:

    AlbConfig.alibabacloud.com/alb-demo created
ingressclass.networking.k8s.io/alb created

  3. Verify the creation of the ALB instance.

    • Method 1: Run the following command to view the ALB instance ID.

      kubectl get albconfig alb-demo     
      [root@i-xxx nuoZ test]# kubectl get albconfig alb-demo
NAME        ALBID                      DNSNAME                                          PORT&PROTOCOL   CERTID   AGE
alb-demo    alb-3lzokczr3c9guq7zz7    alb-3xxx.com                                                               84s

    • Method 2: Log on to the ALB console to view the created ALB instance.

      Note

      You must log on to the console with the Alibaba Cloud account that you configured in the ConfigMap in Step 1: Deploy the alb-ingress-controller.

Step 3: Deploy a test application

This section guides you on using a test image to create deployment resources and deploy a test application.

  1. Create a file named test-service.yaml and copy the following content into it.

    The test-service.yaml file is used to deploy two deployments named test01 and test02, and two services named test01-service and test02-service.

    apiVersion: apps/v1
kind: Deployment
metadata:
  name: test01
spec:
  replicas: 2
  selector:
    matchLabels:
      app: test01
  template:
    metadata:
      labels:
        app: test01
    spec:
      containers:
      - name: test01
        image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: test01-service
spec:
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
  selector:
    app: test01
  type: NodePort
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: test02
spec:
  replicas: 1
  selector:
    matchLabels:
      app: test02
  template:
    metadata:
      labels:
        app: test02
    spec:
      containers:
      - name: test02
        image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: test02-service
spec:
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
  selector:
    app: test02
  type: NodePort

  2. Connect to the cluster by using kubectl and run the following command to apply the test-service.yaml file.

    kubectl apply -f test-service.yaml

    Expected output:

    deployment.apps/test01 created
service/test01-service created
deployment.apps/test02 created
service/test02-service created

  3. Run the following command to verify that the test services were deployed successfully.

    kubectl get svc,deploy

    The following output indicates that the test services are deployed successfully.

    [root@iZ2z***uoZ test]# kubectl get svc,deploy
NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE
service/cloud-nodeport      NodePort    10.xxx.122      <none>        80:31310/TCP     63d
service/kubernetes          ClusterIP   10.xxx.1        <none>        443/TCP          63d
service/test01-service      NodePort    10.xxx.121      <none>        80:31254/TCP     9s
service/test02-service      NodePort    10.xxx.118      <none>        80:30337/TCP     9s
NAME                                        READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/openresty-deployment        2/2     2            2           63d
deployment.apps/test01                      2/2     2            2           9s
deployment.apps/test02                      1/1     1            1           9s

Step 4: Create an ingress

An ingress corresponds to a forwarding rule in an ALB instance. This topic uses path-based routing. For more information about advanced features, see ALB ingress user guide.

  1. Create a file named test-ingress.yaml and copy the following content into it.

    The test-ingress.yaml file is used to create an ingress.

    apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ingress
spec:
  ingressClassName: alb
  rules:
   - host: demo.domain.ingress.top
     http:
      paths:
      - path: /test01
        pathType: Prefix
        backend:
          service:
            name: test01-service
            port:
              number: 80
      - path: /test02
        pathType: Prefix
        backend:
          service:
            name: test02-service
            port:
              number: 80

  2. Connect to the cluster by using kubectl and run the following command to apply the test-ingress.yaml file.

    kubectl apply -f test-ingress.yaml

    Expected output:

    ingress.networking.k8s.io/test-ingress created

  3. Run the following command to verify the creation of the test-ingress resource.

    kubectl get ingress

    The following output indicates that the test-ingress resource was created successfully.

    [root@iZ2zxxx test]# kubectl get ingress
NAME           CLASS   HOSTS                    ADDRESS                                                        PORTS   AGE
test-ingress   alb     demo.domain.ingress.top  alb-xxx.cn-beijing.alb.aliyuncs.com   80      19s

Step 5: Verify the results

Access by domain name

  1. Create a CNAME record to map your domain name to the DNS name of the ALB instance. For more information, see Configure a CNAME record for an ALB instance.

    In this example, assume you map the custom domain name demo.domain.ingress.top to the public DNS name of the ALB instance.

  2. Run the following command to access the test01 service through the ALB instance.

    curl http://demo.domain.ingress.top/test01

    The NGINX backend pod returns a response with details such as Server address (10.xxx.xxx.xxx:80), Server name (test01-648bf46944-kvlhj), Date (07/Nov/2022:08:16:35 +0000), and URI (/test01). This confirms that the ingress correctly routed the request to a backend pod for the test01 service.

  3. Run the following command to access the test02 service through the ALB instance.

    curl http://demo.domain.ingress.top/test02

    The command returns the NGINX test page, which shows the Server address is 10.xxx.20:80, the Server name is test02-76d96f7b8d-6mtnn, and the URI is /test02. This confirms that the ingress correctly routed the request to the test02 backend pod.

For questions, join the ALB Customer Group (DingTalk ID: 31945843) for assistance.

Related documents

ALB ingress overview and features:

Previous：Migrate NGINX Ingress to ALB IngressNext：Authorize a self-managed cluster to use the ALB Ingress controller