Container Service for Kubernetes:Ekspos layanan dengan Gateway API dan ALB

Model resource

Gateway API mendefinisikan tiga jenis resource, masing-masing dikelola oleh peran yang berbeda:

Tim platform mengelola infrastruktur, sedangkan tim aplikasi mengelola aturan routing secara independen.

ALB Ingress Controller telah mendukung Gateway API sejak versi 2.17.0.

Prasyarat

Pastikan hal-hal berikut:

• Kluster ACK yang dikelola menjalankan Kubernetes 1.24 atau lebih baru.

• ALB Ingress Controller versi 2.17.0 atau lebih baru telah diinstal di kluster.

• Gateway API versi 1.1.0 atau lebih baru telah diinstal di kluster.

• Dua vSwitch yang mendukung ALB tersedia di VPC tempat kluster Anda dideploy.

Verifikasi lingkungan

ALB Ingress Controller secara otomatis membuat resource GatewayClass bernama alb. Verifikasi keberadaannya sebelum melanjutkan.

kubectl get gatewayclass

NAME   CONTROLLER                         ACCEPTED   AGE
alb    gateways.alibabacloud.com/alb/v1   True       1m

Deploy aplikasi contoh

Buat file httpbin.yaml:

Layanan menggunakan ClusterIP secara default. Jika kluster Anda menggunakan plug-in jaringan Flannel, ubah spec.type menjadi NodePort.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: go-httpbin
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: go-httpbin
  template:
    metadata:
      labels:
        app: go-httpbin
        version: v1
    spec:
      containers:
        - image: registry.cn-hangzhou.aliyuncs.com/mse/go-httpbin
          args:
            - "--port=8090"
            - "--version=v1"
          imagePullPolicy: Always
          name: go-httpbin
          ports:
            - containerPort: 8090
---
apiVersion: v1
kind: Service
metadata:
  name: go-httpbin
  namespace: default
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: 8090
      protocol: TCP
  selector:
    app: go-httpbin

Terapkan manifes:

kubectl apply -f httpbin.yaml

Deploy Gateway dan aturan routing

Langkah 1: Buat Gateway dan HTTPRoute

Buat file gateway.yaml:

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: alb
  namespace: default
spec:
  gatewayClassName: alb
  listeners:
    - name: http
      protocol: HTTP
      port: 80
      hostname: "*.ingress.top"
      allowedRoutes:
        namespaces:
          from: Same
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: demo-route
spec:
  parentRefs:            # Lampirkan rute ini ke Gateway di atas
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: alb
  hostnames:
    - demo.ingress.top
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:       # Teruskan traffic yang cocok ke go-httpbin pada port 80
        - kind: Service
          name: go-httpbin
          port: 80

Gateway menyediakan instans ALB dengan listener HTTP pada port 80 untuk *.ingress.top. HTTPRoute meneruskan lalu lintas untuk demo.ingress.top ke layanan go-httpbin.

Terapkan manifes:

kubectl apply -f gateway.yaml

Langkah 2: Tunggu hingga Gateway siap

kubectl wait --for=condition=programmed gateway/alb --timeout=120s

Verifikasi alamat Gateway:

kubectl get gateway alb

Contoh output:

NAME   CLASS   ADDRESS                                                  PROGRAMMED   AGE
alb    alb     alb-0mwhq4ck6xxxxxxxxx.cn-hangzhou.alb.aliyuncsslb.com   True         2m12s

Langkah 3: Periksa status HTTPRoute

kubectl describe httproute demo-route | grep Status -A 20

Contoh output:

Status:
  Parents:
    Conditions:
      Last Transition Time:  2025-05-23T08:21:25Z
      Message:               Route is accepted.
      Observed Generation:   1
      Reason:                Accepted
      Status:                True
      Type:                  Accepted
      Last Transition Time:  2025-05-23T08:21:25Z
      Message:               Route is resolved.
      Observed Generation:   1
      Reason:                ResolvedRefs
      Status:                True
      Type:                  ResolvedRefs
    Controller Name:         gateways.alibabacloud.com/alb/v1
    Parent Ref:
      Group:  gateway.networking.k8s.io
      Kind:   Gateway
      Name:   alb

Accepted: True dan ResolvedRefs: True mengonfirmasi bahwa rute aktif.

Langkah 4: Uji akses

Ambil alamat Gateway dan kirim permintaan uji:

export ALB_DOMAIN=$(kubectl get gateway alb -n default -o jsonpath='{.status.addresses[?(@.type=="Hostname")].value}')
curl -H "Host: demo.ingress.top" http://${ALB_DOMAIN}/version

Contoh output:

version: v1
hostname: go-httpbin-547xxxxxf6-xxxxx

Kasus penggunaan

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: demo-filter
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: alb
  hostnames:
    - filter.ingress.top
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      filters:
        - type: RequestHeaderModifier
          requestHeaderModifier:
            add:
              - name: my-header
                value: foo
      backendRefs:
        - kind: Service
          name: go-httpbin
          port: 80

kubectl apply -f httproute-filter.yaml

curl -H "Host: filter.ingress.top" http://${ALB_DOMAIN}/header

headers: {
    "Accept": [
      "*/*"
    ],
    "Connection": [
      "close"
    ],
    "Host": [
      "filter.ingress.top"
    ],
    "My-Header": [
      "foo"
    ],
    "Path": [
      "/header"
    ],
    "Protocol": [
      "HTTP/1.1"
    ],
    "Remoteip": [
      "118.xx.xx.91"
    ],
    "URL": [
      "/header"
    ],
    "User-Agent": [
      "curl/8.9.1"
    ]
  }
 query param:
, hostname: go-httpbin-547xxxxxf6-xxxxx

apiVersion: apps/v1
kind: Deployment
metadata:
  name: old-nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      run: old-nginx
  template:
    metadata:
      labels:
        run: old-nginx
    spec:
      containers:
      - image: registry.cn-hangzhou.aliyuncs.com/acs-sample/old-nginx
        imagePullPolicy: Always
        name: old-nginx
        ports:
        - containerPort: 80
          protocol: TCP
      restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
  name: old-nginx
spec:
  type: ClusterIP
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: old-nginx
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: new-nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      run: new-nginx
  template:
    metadata:
      labels:
        run: new-nginx
    spec:
      containers:
      - image: registry.cn-hangzhou.aliyuncs.com/acs-sample/new-nginx
        imagePullPolicy: Always
        name: new-nginx
        ports:
        - containerPort: 80
          protocol: TCP
      restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
  name: new-nginx
spec:
  type: ClusterIP
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: new-nginx

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: demo-weight
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: alb
  hostnames:
    - weight.ingress.top
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        # Bobot bersifat relatif, bukan persentase — tidak perlu berjumlah 100.
        - kind: Service
          name: old-nginx
          port: 80
          weight: 100
        - kind: Service
          name: new-nginx
          port: 80
          weight: 100

kubectl apply -f nginx.yaml
kubectl apply -f httproute-weight.yaml

for i in {1..10}; do curl -H "Host: weight.ingress.top" http://${ALB_DOMAIN}/; done

old
new
new
old
new
old
old
new
new
old

Konfigurasikan sertifikat TLS

Tambahkan terminasi HTTPS ke Gateway dengan mereferensikan Secret Kubernetes yang berisi sertifikat TLS Anda.

Langkah 1: Buat sertifikat tanda tangan sendiri

openssl req -subj '/CN=ingress.top' -new -newkey rsa:2048 -sha256 \
  -days 365 -nodes -x509 -keyout server.key -out server.crt \
  -addext "subjectAltName = DNS:ingress.top" \
  -addext "keyUsage = digitalSignature" \
  -addext "extendedKeyUsage = serverAuth" 2> /dev/null; \
  openssl x509 -in server.crt -subject -noout

Langkah 2: Buat Secret TLS

kubectl create secret tls ingress.top --key server.key --cert server.crt

Langkah 3: Perbarui Gateway untuk menambahkan listener HTTPS

Buat file gateway-tls.yaml:

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: alb
  namespace: default
spec:
  gatewayClassName: alb
  listeners:
    - name: http
      protocol: HTTP
      port: 80
      hostname: "*.ingress.top"
      allowedRoutes:
        namespaces:
          from: Same
    - name: https
      protocol: HTTPS
      port: 443
      hostname: "*.ingress.top"
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        mode: Terminate          # ALB menghentikan TLS dan meneruskan HTTP biasa ke backend
        certificateRefs:
          - kind: Secret
            name: ingress.top   # Secret yang dibuat pada langkah sebelumnya

Dalam mode Terminate, ALB mendekripsi traffic HTTPS dan meneruskan HTTP biasa ke backend. Field certificateRefs mereferensikan Secret yang menyimpan sertifikat dan kunci privat.

Terapkan pembaruan:

kubectl apply -f gateway-tls.yaml

Langkah 4: Verifikasi sertifikat

Tunggu hingga status PROGRAMMED Gateway kembali menjadi True:

kubectl wait --for=condition=programmed gateway/alb --timeout=120s

Verifikasi sertifikat:

openssl s_client -servername ingress.top -connect ${ALB_DOMAIN}:443

Contoh output:

CONNECTED(00000003)
depth=0 CN = ingress.top
verify error:num=18:self-signed certificate
verify return:1
depth=0 CN = ingress.top
verify return:1
---
Certificate chain
 0 s:CN = ingress.top
   i:CN = ingress.top
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jun 24 10:49:39 2025 GMT; NotAfter: Jun 24 10:49:39 2026 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
subject=CN = ingress.top
issuer=CN = ingress.top
---
...
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
...
Verify return code: 18 (self-signed certificate)

CN = ingress.top dan cipher TLSv1.2 mengonfirmasi bahwa terminasi TLS berfungsi. Error self-signed certificate adalah hal yang diharapkan — gunakan sertifikat yang ditandatangani CA di lingkungan produksi.

Uji akses HTTPS dengan flag -k untuk melewati verifikasi sertifikat tanda tangan sendiri:

curl -H "Host: demo.ingress.top" -k https://${ALB_DOMAIN}/version

Contoh output:

version: v1
hostname: go-httpbin-547xxxxxf6-xxxxx

Langkah selanjutnya

• Gateway API — Spesifikasi lengkap, termasuk routing lanjutan seperti pencocokan berbasis header dan pencerminan lalu lintas.

• ALB Ingress Controller — Anotasi dan konfigurasi spesifik ALB untuk beban kerja produksi.