Container Compute Service:Quick start for ALB Ingress

How it works

ALB Ingress relies on four Kubernetes resources that map to a single ALB instance:

The ALB Ingress Controller is the control plane. It retrieves Ingress and AlbConfig changes through the API Server and configures the ALB instance, but does not handle user traffic directly.

Limitations

• Names of AlbConfig, namespace, Ingress, and Service resources cannot start with aliyun.

• Earlier versions of the Nginx Ingress controller do not recognize the spec.ingressClassName field. If both Nginx Ingresses and ALB Ingresses exist in your cluster, the ALB Ingresses may be incorrectly reconciled by an older Nginx Ingress controller. To prevent this, upgrade the Nginx Ingress controller or use annotations to specify IngressClasses.

Prerequisites

Before you begin, make sure that you have:

• The ALB Ingress Controller installed in the cluster

• Two vSwitches in different zones within the same VPC as the cluster (see Create and manage vSwitches)

Step 1: Deploy backend services

Deploy two Deployments (coffee and tea, each with 2 replicas) and two corresponding ClusterIP Services (coffee-svc and tea-svc).

Save the following YAML as cafe-service.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: coffee
spec:
  replicas: 2
  selector:
    matchLabels:
      app: coffee
  template:
    metadata:
      labels:
        app: coffee
    spec:
      containers:
      - name: coffee
        image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: coffee-svc
spec:
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
  selector:
    app: coffee
  type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tea
spec:
  replicas: 2
  selector:
    matchLabels:
      app: tea
  template:
    metadata:
      labels:
        app: tea
    spec:
      containers:
      - name: tea
        image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: tea-svc
spec:
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
  selector:
    app: tea
  type: ClusterIP

Step 2: Create an AlbConfig

An AlbConfig provisions an ALB instance. The YAML below creates an Internet-facing ALB with an HTTP listener on port 80.

Save the following YAML as alb-test.yaml. Replace the vSwitch ID placeholders with your actual values.

apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: alb-demo
spec:
  config:
    name: alb-test
    addressType: Internet
    zoneMappings:
    - vSwitchId: <vsw-id-zone-1>   # vSwitch in zone 1
    - vSwitchId: <vsw-id-zone-2>   # vSwitch in zone 2 (must differ from zone 1)
  listeners:
    - port: 80
      protocol: HTTP

Parameter reference:

Step 3: Create an IngressClass

An IngressClass links an Ingress to an AlbConfig. Each IngressClass maps to exactly one AlbConfig.

Save the following YAML as alb.yaml:

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: alb
spec:
  controller: ingress.k8s.alibabacloud/alb
  parameters:
    apiGroup: alibabacloud.com
    kind: AlbConfig
    name: alb-demo

Step 4: Create an Ingress

The Ingress defines path-based routing rules. Requests matching /coffee are forwarded to coffee-svc, and requests matching /tea are forwarded to tea-svc.

Save the following YAML as cafe-ingress.yaml:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
spec:
  ingressClassName: alb
  rules:
  - host: demo.domain.ingress.top
    http:
      paths:
      - path: /tea
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 80
      - path: /coffee
        pathType: ImplementationSpecific
        backend:
          service:
            name: coffee-svc
            port:
              number: 80

(Optional) Step 5: Configure domain name resolution

If you set a custom domain in spec.rules.host, add a CNAME record that resolves the domain to the ALB DNS name. This step is not required if you plan to test using the ALB DNS name directly.

1. Log on to the ACS console and navigate to your cluster.

2. In the left navigation pane, choose Network > Ingresses.

3. In the Endpoints column for cafe-ingress, copy the DNS name.

4. Add a CNAME record in DNS:

   1. Log on to the Alibaba Cloud DNS console.

   2. On the Domain Names page, click Add Domain Name and enter the host domain name. > Important: The host domain name must have passed TXT record verification.

   3. In the Actions column of the domain, click Configure.

   4. Click Add Record and configure the following: | Setting | Value | |---|---| | Type | CNAME | | Host | The prefix of the domain name, such as www | | Resolution Request Source | Default | | Value | The ALB DNS name copied in the previous step | | TTL | Default |

   5. Click OK.

Step 6: Test traffic forwarding

Open a browser and access the test domain with each path. If you configured a custom domain with DNS resolution, use that domain. Otherwise, use the ALB DNS name from Step 4.

• If you configured a custom domain name, the test domain name is your custom domain name.

• If you did not configure a custom domain name, the test domain name is the endpoint DNS name of cafe-ingress.

This example uses demo.domain.ingress.top as the domain.

1. Access demo.domain.ingress.top/coffee. The response should come from the coffee-svc backend.

2. Access demo.domain.ingress.top/tea. The response should come from the tea-svc backend.

Clean up resources

The ALB instance created by the AlbConfig incurs charges even when idle. To remove all resources created in this tutorial, delete them in reverse order:

kubectl delete -f cafe-ingress.yaml
kubectl delete -f alb.yaml
kubectl delete -f alb-test.yaml
kubectl delete -f cafe-service.yaml

References

• Advanced configurations for ALB Ingress -- forwarding by domain or URL path, health checks, HTTP-to-HTTPS redirect, canary releases, and custom listener ports

• Customize forwarding rules for ALB Ingress -- forwarding conditions and actions

• Configure an HTTPS certificate for encrypted communication -- HTTPS listener setup

• Troubleshoot ALB Ingress issues and ALB Ingress FAQ